Signal is active with 4 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.go:13-16 stores it. Callers at internal/api/enroll.go:116, internal/api/updates.go:297, and internal/api/mobile_bundle.go:40 use the manager for one Sign() and drop the reference on function return — but the underlying slice contents are not wiped before release. The keystore package's contract (internal/keystore/keystore.go doc: "Callers MUST zeroise the returned plaintext DEK as soon as it is no longer needed") is not met by the CAManager consumer. Decrypted CA private keys persist in process heap until Go's GC scavenges the underlying slice — minutes to hours under load, indefinitely on idle servers. This issue has been patched in version 0.3.7.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-48025 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManage… https://www.cve.org/CVERecord?id=CVE-2026-48025
Post summary
The post announces a CVE‑2026‑48025 in Nebula‑mesh, noting a vulnerable code section before version 0.3.7, but provides no PoC, exploit, patch or detailed vulnerability information.
🚨*CVE* CVE-2026-48025 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManage… https://www.cve.org/CVERecord?id=CVE-2026-48025 ----- Traducción: CVE-2026-48025 neb… http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑48025 affecting nebula‑mesh prior to version 0.3.7 with a brief code reference, but offers no exploitation or patch details.
CVE-2026-48025 Unwiped Decrypted CA Private Keys in nebula-mesh Control Plane Before 0.3.7 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48025
Post summary
The post announces the discovery of CVE-2026-48025, a bug causing decrypted CA private keys to remain unwiped in nebula‑mesh control planes before version 0.3.7; no exploitation, patch, or PoC details are provided.
CVE-2026-48025 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManage… https://www.cve.org/CVERecord?id=CVE-2026-48025
Post summary
CVE‑2026‑48025 affects code in nebula‑mesh before version 0.3.7, but the text offers only the technical details of the vulnerability and no evidence of PoC, exploit, active weaponisation, or patch.