CVE-2026-61699

    Dashboard / Vulnerabilities / CVE-2026-61699

    CVE-2026-61699

    Published: 4 Sept 2026Last Modified: 10 Sept 2026

    Summary: nebula-mesh: Certificate revocation is never enforced at the mesh

    Details: nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay reachability to every peer under its CA (and internal services on the mesh) for up to 30d (agent) / 365d (mobile). An attacker who exfiltrates host.key+host.crt can run stock slackhq/nebula directly, ignore the agent's 403/410 poll responses, and stay connected after the operator revokes the host. Operator-visible state (UI shows blocked, audit log records it) is misleading. This issue has been patched in version 0.7.1.

    References: https://github.com/forgekeep/nebula-mesh/releases/tag/v0.7.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61699.json, https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-cm26-5974-52h8, https://nvd.nist.gov/vuln/detail/CVE-2026-61699, https://github.com/forgekeep/nebula-mesh/commit/0426e2f224a9b1e2029029bf923c93ed39d21cdb

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -0426e2f224a9b1e2029029bf923c93ed39d21cdb

    Affected versions

    v0.7.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-61699 | CVE-DB