CyberRota Analysis
AI-GeneratedThe vulnerability affects the nebula-mesh control plane for Slack Nebula mesh VPN, allowing compromised or offboarded hosts to maintain full overlay reachability to all peers and internal services for extended periods, despite being blocked. This can lead to unauthorized access and potential data exfiltration, as attackers can exploit the situation by using stolen credentials to remain connected even after revocation. Organizations using versions prior to 0.7.1 should prioritize patching to mitigate this significant security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay reachability to every peer under its CA (and internal services on the mesh) for up to 30d (agent) / 365d (mobile). An attacker who exfiltrates host.key+host.crt can run stock slackhq/nebula directly, ignore the agent's 403/410 poll responses, and stay connected after the operator revokes the host. Operator-visible state (UI shows blocked, audit log records it) is misleading. This issue has been patched in version 0.7.1.