nebula-mesh CVE-2026-53604
HIGH
GHSA-2p2f-px33-4vv5
Severity by source
Recovering the key needs privileged process-memory read (AV:L, PR:H) within a nondeterministic GC window (AC:H); direct impact is disclosure of the CA key (C:H), with no direct integrity or availability effect.
Lifecycle Timeline
3DescriptionCVE.org
Impact
The web handler renderMobileBundle (internal/web/handlers.go:1325) passes the real *pki.CAResolver directly into mobilebundle.Build. Inside Build (internal/mobilebundle/builder.go:54), resolver.LoadByID decrypts the CA's ed25519 private key into a *pki.CAManager, but Build never calls CAManager.Wipe() on any return path (success or any of the error paths at lines 56, 62, 68, 80, 86, 92, 98, 102, 109, 118, 150).
As a result, when a mobile-bundle request goes through the web UI and Build returns - especially on error (missing network, invalid prefix, DB error, signing failure) - the plaintext CA private key remains on the Go heap, unwiped, until garbage collection. An attacker able to read process memory (core dump, swap, memory-scraping) can recover the CA signing key, which would allow minting arbitrary host certificates for the mesh.
The API handler (internal/api/mobile_bundle.go:74) already does this correctly: it loads the CAManager, defer caMgr.Wipe(), and wraps it in caManagerResolver. Only the web path is affected.
This is the same key-zeroization class previously addressed in GHSA-8h84-fhqq-q58v.
Patches
Add defer caMgr.Wipe() inside mobilebundle.Build immediately after the LoadByID call so every caller (web and API) is protected on all return paths. Ensure CAManager.Wipe() is idempotent, since the API handler also wipes the same manager.
Workarounds
None at the configuration level; requires a code fix.
Resources
internal/web/handlers.go:1325internal/mobilebundle/builder.go:54internal/api/mobile_bundle.go:74(correct reference implementation)- Prior related advisory: GHSA-8h84-fhqq-q58v
AnalysisAI
Sensitive CA key exposure in forgekeep/nebula-mesh (<= 0.3.7) leaves the decrypted ed25519 CA signing key resident on the Go heap after web-UI mobile-bundle requests, because mobilebundle.Build never calls CAManager.Wipe() on any return path. An attacker who can read the process's memory (core dump, swap, or memory scraping) can recover the plaintext CA key and mint arbitrary host certificates for the mesh. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the mobile-bundle must be requested through the WEB UI handler (renderMobileBundle / internal/web/handlers.go:1325) - the API path at internal/api/mobile_bundle.go:74 is NOT vulnerable; (2) the attacker must be able to read the nebula-mesh process's memory, i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS, EPSS, KEV, or SSVC data was provided, so all scoring here is independently assessed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has gained local/root access to the nebula-mesh server (or who obtains a core dump or swap image from it) triggers or waits for a web-UI mobile-bundle request - easily forced to fail via an invalid prefix or missing network - leaving the decrypted CA ed25519 key on the heap. The attacker then scrapes process memory to recover the plaintext signing key and uses it offline to mint trusted host certificates and join rogue nodes to the mesh. … |
| Remediation | Vendor-released patch: 0.3.8 - upgrade github.com/forgekeep/nebula-mesh to v0.3.8 or later (release https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.8; fix commit https://github.com/forgekeep/nebula-mesh/commit/1f1ab9aa8472239763d967e3d50a3cd53a1a79b9), which adds 'defer caMgr.Wipe()' immediately after LoadByID inside mobilebundle.Build so both web and API callers are protected on every return path, with Wipe made idempotent and nil-safe. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running forgekeep/nebula-mesh version 0.3.7 or earlier and assess which operate in privileged roles (control planes, certificate authorities). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today