CVE-2026-61699 Details
Description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay reachability to every peer under its CA (and internal services on the mesh) for up to 30d (agent) / 365d (mobile). An attacker who exfiltrates host.key+host.crt can run stock slackhq/nebula directly, ignore the agent's 403/410 poll responses, and stay connected after the operator revokes the host. Operator-visible state (UI shows blocked, audit log records it) is misleading. This issue has been patched in version 0.7.1.
A vulnerability in Nebula Mesh VPN's revocation process allows compromised or offboarded hosts to maintain full connectivity with other peers and internal services for extended periods. This issue affects Nebula Mesh versions prior to 0.7.1. The problem arises because the revocation blocklist is not properly communicated to peer configurations, leaving blocked hosts with active overlay reachability. An attacker could exploit this by exfiltrating the host's private key and certificate, bypassing revocation measures and remaining connected to the network.
Users can upgrade to Nebula Mesh version 0.7.1, which addresses this vulnerability by ensuring that the blocklist is properly emitted in the 'pki.blocklist' section of the configuration file. After updating, the Nebula agent should be restarted to apply the changes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-cm26-5974-52h8 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/forgekeep/nebula-mesh/commit/0426e2f224a9b1e2029029bf923c93ed39d21cdb | [email protected] | Source CodeVendor |
| https://github.com/forgekeep/nebula-mesh/releases/tag/v0.7.1 | [email protected] | Release NotesVendor |
| https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-cm26-5974-52h8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-299 | Improper Check for Certificate Revocation | [email protected] |
| CWE-672 | Operation on a Resource after Expiration or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| forgekeep nebula-mesh | <= 0.7.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |