CVE-2026-53602

Name of the Vulnerable Software and Affected Versions nebula-mesh versions 0.3.6 and earlier

Description Two authorization gaps in nebula-mgmt allow untrusted hosts to obtain valid certificates. First, the system fails to enforce the blocklist during certificate issuance or re-enrollment. Because the blocklist is keyed by certificate fingerprint, a re-enrolling host receives a new fingerprint that bypasses existing blocklist checks. Additionally, the mintEnrollmentTokenForHost() function does not verify host status, allowing a blocked host to transition back to an enrolled state. Second, the auto-renewal process does not re-validate the status of the owning operator or the Certificate Authority (CA). Consequently, hosts provisioned by a disabled operator can continue renewing certificates indefinitely, as the system only checks for time-expiry rather than operator or CA status.

Recommendations Implement a blocklist and status guard within handleEnroll and signHostCert to refuse certificate issuance for hosts with a blocked status or a fingerprint on the blocklist, requiring an explicit unblock before re-enrollment. Re-resolve the owning operator and CA status during the renewal process and reject renewals if the operator is disabled or the CA is retired. As a temporary mitigation, restrict the use of the mintEnrollmentTokenForHost() function for hosts that have been previously blocked.