CVE-2026-53604

nebula-mesh, a self-hosted control plane for Slack's Nebula mesh VPN, leaves the decrypted Certificate Authority (CA) ed25519 private key unwiped on the Go heap after mobile-bundle generation through its web UI in versions prior to 0.3.8. The web handler renderMobileBundle passes the real CA resolver into mobilebundle.Build, which decrypts the CA private key but never calls CAManager.Wipe() on any return path — especially on errors such as a missing network, invalid prefix, database failure, or signing failure — so the plaintext key lingers in memory until garbage collection, while the API handler performs this correctly and is unaffected. An attacker who can read process memory, such as via core dumps, swap files, or memory scraping on the host, can recover the CA signing key and use it to mint arbitrary host certificates for the mesh VPN. Only self-hosted deployments that trigger mobile-bundle generation through the web UI are affected. No public proof-of-concept or known exploitation exists, and EPSS estimates the 30-day exploitation probability at roughly 0.1%.

What to do: Upgrade nebula-mesh to version 0.3.8 or later. As an interim measure, generate mobile bundles via the API endpoint instead of the web UI, since that path correctly wipes the CA key, and reduce process-memory exposure by disabling core dumps and encrypting swap on the host. If host memory may have been read (core dump, swap, or memory scraping), consider rotating the CA key and re-issuing host certificates.