CVE-2026-61699

Katalog CVE

CVSS 8.1 · High EPSS 0,45%

Kerentanan Improper Check for Certificate Revocation. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay reachability to every peer under its CA (and internal services on the mesh) for up to 30d (agent) / 365d (mobile). An attacker who exfiltrates host.key+host.crt can run stock slackhq/nebula directly, ignore the agent's 403/410 poll responses, and stay connected after the operator revokes the host. Operator-visible state (UI shows blocked, audit log records it) is misleading. This issue has been patched in version 0.7.1.

Rincian

Terbit di NVD

4 September 2026

Terakhir diubah

8 September 2026

Status NVD

Deferred

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-299: Improper Check for Certificate Revocation
CWE-672: Operation on a Resource after Expiration or Release

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 36,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/forgekeep/nebula-mesh/commit/0426e2f224a9b1e2029029bf923c93ed39d21cdb
• https://github.com/forgekeep/nebula-mesh/releases/tag/v0.7.1
• https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-cm26-5974-52h8