CVE-2026-53602: nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate

July 9, 2026

Two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate issuance time — only at poll time.

References

github.com/advisories/GHSA-339v-266x-79xr
github.com/forgekeep/nebula-mesh/issues/178
github.com/forgekeep/nebula-mesh/security/advisories/GHSA-339v-266x-79xr
nvd.nist.gov/vuln/detail/CVE-2026-53602

Code Behaviors & Features

Detect and mitigate CVE-2026-53602 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →