CVE-2026-61699
Received Received - Intake

Security Bypass in Nebula-Mesh VPN

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: GitHub, Inc.

Description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay reachability to every peer under its CA (and internal services on the mesh) for up to 30d (agent) / 365d (mobile). An attacker who exfiltrates host.key+host.crt can run stock slackhq/nebula directly, ignore the agent's 403/410 poll responses, and stay connected after the operator revokes the host. Operator-visible state (UI shows blocked, audit log records it) is misleading. This issue has been patched in version 0.7.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-61699

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
slackhq nebula to 0.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-299 The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.
CWE-672 The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in nebula-mesh (before version 0.7.1) allows a compromised or offboarded host to remain connected to the Nebula mesh VPN even after being revoked. The blocklist mechanism fails to propagate to peers' config.yml files, leaving the host fully accessible for up to 30 days (agent) or 365 days (mobile). Attackers with stolen host.key and host.crt files can bypass revocation and maintain unauthorized access.

Detection Guidance

This vulnerability cannot be reliably detected through standard network or system commands due to the attacker's ability to bypass revocation and remain connected using stolen credentials. The operator-visible state may show the host as blocked, but the attacker can still access the mesh. Monitor for unusual persistent connections from revoked hosts or unauthorized access attempts.

Impact Analysis

If you use nebula-mesh prior to version 0.7.1, a compromised host could remain connected to your VPN, allowing attackers to access internal services or exfiltrate data. The vulnerability enables persistent unauthorized access despite revocation attempts, potentially leading to data breaches or continued network compromise.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data, which is prohibited under GDPR and HIPAA. Persistent access by compromised hosts risks data breaches, leading to potential fines or legal consequences for failing to maintain proper access controls.

Mitigation Strategies

Upgrade nebula-mesh to version 0.7.1 or later to apply the patch. Rotate all host certificates and keys immediately to invalidate any stolen credentials. Review audit logs for signs of unauthorized access and block any suspicious IPs. Ensure all peers are running the updated version to prevent re-exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61699. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart