{"id":17581,"date":"2026-09-06T02:30:47","date_gmt":"2026-09-05T18:30:47","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-53602"},"modified":"2026-09-06T02:30:47","modified_gmt":"2026-09-05T18:30:47","slug":"cve-2026-53602","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-53602","title":{"rendered":"CVE-2026-53602 &#8211; nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3"},"content":{"rendered":"<p>nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation\/authorization state at certificate issuance time \u2014 only at poll time. Firstly, the blocklist is not enforced at sign \/ re-enroll time. internal\/api\/enroll.go:128 calls caMgr.Sign(&#8230;) without consulting the blocklist. The blocklist is only checked in the poll path (internal\/api\/updates.go:57, fingerprintInBlocklist). The blocklist is keyed by certificate fingerprint (internal\/store\/sqlite.go), so a re-enrollment produces a new fingerprint that is not in the blocklist. Secondly, renewal does not re-validate operator \/ CA status. Auto-renewal at poll time (internal\/api\/updates.go:285-319, signHostCert) reads host.Name, host.Groups, host.NebulaIPs from the DB and re-signs without checking whether the owning operator is still active or the CA still valid. DisableOperator (internal\/store\/sqlite_operators.go) revokes sessions and API keys but does not retire the operator&#8217;s CAs, and pki\/signer.go checks only CA cert time-expiry, not operator\/CA status. This issue has been patched in version 0.3.7.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula ce<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17581","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17581","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17581"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17581"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17581"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}