CVE-2026-25793 Nebula Has Possible Blocklist Bypass via ECDSA Signature Malleability
Attackers can bypass certificate blocklists in Nebula by exploiting ECDSA signature malleability when using non-default P256 certificates.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25793?
CVE-2026-25793 is a high-severity vulnerability in slackhq nebula, published on 6 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of the certificate with a different fingerprint. This issue has been patched in version 1.10.3.
Weakness: CWE-347
Which versions are affected by CVE-2026-25793?
3 open source packages ship an affected version, including github.com/slackhq/nebula. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/slackhq/nebula Go | From 1.7.0 | 1.10.3 |
github.com/slackhq/nebula Go | From 1.7.0 | 1.10.3 |
github.com/slackhq/nebula Go | From 1.7.0 | 1.10.3 |
Products include Slack Nebula.
How do I fix CVE-2026-25793?
Upgrade github.com/slackhq/nebula to 1.10.3 or later.
Is CVE-2026-25793 being exploited?
There is no known exploitation of CVE-2026-25793 in the wild and no public exploit code.
Other vulnerabilities in slackhq nebula
Sources
Also known as CLEANSTART-2026-FB73701, CLEANSTART-2026-XI53576, CLEANSTART-2026-ZG76614, GHSA-69x3-g4r3-p962, GO-2026-4458, MINI-8qgr-99vw-p8xr.