CVE-2026-48025

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.go:13-16 stores it. Callers at internal/api/enroll.go:116, internal/api/updates.go:297, and internal/api/mobile_bundle.go:40 use the manager for one Sign() and drop the reference on function return — but the underlying slice contents are not wiped before release. The keystore package's contract (internal/keystore/keystore.go doc: "Callers MUST zeroise the returned plaintext DEK as soon as it is no longer needed") is not met by the CAManager consumer. Decrypted CA private keys persist in process heap until Go's GC scavenges the underlying slice — minutes to hours under load, indefinitely on idle servers. This issue has been patched in version 0.3.7.

• CWE-244

• https://github.com/forgekeep/nebula-mesh/commit/bca1d5914fbaf3517d3b86145a802c00de4a8122
• https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.7
• https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-8h84-fhqq-q58v

Published

Jul 28, 2026

Last Modified

Jul 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48016Shopware is an open commerce platform. Prior to 6.6.10.18 an…4.3
• CVE-2026-48017DbGate is cross-platform database manager. In versions 7.1.8…8.8
• CVE-2026-4802A flaw was found in Cockpit. This vulnerability allows a rem…8
• CVE-2026-48020Traefik is an HTTP reverse proxy and load balancer. Prior to…10
• CVE-2026-48021In epa4all, prior to version 2026-05-20, an attacker who can…9.1
• CVE-2026-48022@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wrec…6.5
• CVE-2026-48026lakeFS is an open-source tool that transforms object storage…8.7
• CVE-2026-48027Nx Console is the user interface for Nx & Lerna. On 19 May 2…9.8
• CVE-2026-48028Mastodon is a free, open-source social network server based …6.5
• CVE-2026-48029libheif is a HEIF and AVIF file format decoder and encoder. …7.1
• CVE-2026-4803The Royal Elementor Addons plugin for WordPress is vulnerabl…7.2
• CVE-2026-48030Pheditor is a single-file editor and file manager written in…9.9