CVE-2026-53604

nebula-mesh (a self-hosted control plane for Slack Nebula mesh VPN by forgekeep ) is affected by a key-zeroization flaw in its web UI mobile-bundle path. The renderMobileBundle handler passes a decrypted *pki.CAManager containing the CA's ed25519 private key into mobilebundle.Build, which never c...

Sensitive Information Exposure

github.com/forgekeep/nebula-mesh is vulnerable to Sensitive Information Exposure. The vulnerability is due to the web handler passing a decrypted CAManager containing the CA's private key to the mobile bundle builder without invoking CAManager.Wipe on any return path, leaving the plaintext privat...

GO-2026-5191 nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store in github.com/juev/nebula-mesh

nebula-mesh: POST /api/v1/hosts/id/mobile-bundle response lacks Cache-Control: no-store in github.com/juev/nebula-mesh...

nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store

internal/api/mobilebundle.go:62-66 sets only Content-Type: application/yaml. The Web-UI sibling at internal/web/handlers.go:1316-1321 sets Cache-Control: no-store, Pragma: no-cache, Expires: 0, X-Content-Type-Options: nosniff — and has a test asserting it. The API path was missed. Affected All...