nebula-mesh: CA Private Key Exposure via Unzeroized Memory

Executive Summary

A high-severity vulnerability (CVE-2026-53604, CVSS 8.7) in nebula-mesh's web UI allows an attacker with access to process memory to recover the CA private key due to improper zeroization on error paths. This affects versions <= 0.3.7, with 0.3.8 being the first patched version.

Technical Analysis

The vulnerability is caused by the `mobilebundle.Build` function not calling `CAManager.Wipe()` on any return path, leaving the CA private key in plaintext on the Go heap until garbage collection. The `renderMobileBundle` web handler passes a `*pki.CAResolver` to `mobilebundle.Build`, which decrypts the CA's ed25519 private key into a `*pki.CAManager`. An attacker able to read process memory can recover the key.

How It Gets Exploited

An attacker with access to the process memory (e.g., via core dumps, swap files, or memory scraping) can exploit this vulnerability. When a mobile-bundle request goes through the web UI and `Build` returns, especially on error, the plaintext CA private key remains on the heap. The attacker can then recover the CA signing key, allowing them to mint arbitrary host certificates for the mesh.

Impact Assessment

The vulnerability affects nebula-mesh versions <= 0.3.7. Successful exploitation allows an attacker to recover the CA private key, enabling them to mint arbitrary host certificates. The CVSS score is 8.7, indicating a high severity.

Recommended Actions

- Update nebula-mesh to version 0.3.8 or later. - Ensure `CAManager.Wipe()` is called on all return paths in `mobilebundle.Build`. - Verify that `CAManager.Wipe()` is idempotent to prevent issues with the API handler.

Sources

- GitHub Security Advisories: https://github.com/advisories/GHSA-2p2f-px33-4vv5