{"answers":{"affected":"5 open source packages ship an affected version, including github.com/juev/nebula-mesh and github.com/forgekeep/nebula-mesh.","exploited":"There is no known exploitation of CVE-2026-48025 in the wild and no public exploit code.","fix":"Upgrade github.com/juev/nebula-mesh to 0.3.7 or later.","what":"CVE-2026-48025 is a medium-severity vulnerability in juev nebula-mesh, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-48025 and fix it if it is affected.\n\nWhat it is: CVE-2026-48025 is a medium-severity vulnerability in juev nebula-mesh, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-48025 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/juev/nebula-mesh (Go): affected all versions; fixed in 0.3.7\n- github.com/juev/nebula-mesh (Go): affected all versions; fixed in 0.3.7\n- github.com/forgekeep/nebula-mesh (Go): affected all versions; fixed in 0.3.7\n- github.com/forgekeep/nebula-mesh (Go): affected all versions; fixed in 0.3.7\n- github.com/forgekeep/nebula-mesh (Go): affected all versions; fixed in 0.3.7\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-48025/ (Markdown: https://insights.sbomify.com/CVE-2026-48025/index.md)","id":"CVE-2026-48025","markdown":"https://insights.sbomify.com/CVE-2026-48025/index.md","name":"CVE-2026-48025","record":{"aliases":["GHSA-8h84-fhqq-q58v","GO-2026-5255"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Nebula mesh control plane","requires_auth":"none","summary":"Attackers with heap access can recover decrypted CA private keys from nebula-mesh control plane memory due to missing zeroization.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":6.9,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-244","name":"Improper Clearing of Heap Memory Before Release"}],"description":"nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.go:13-16 stores it. Callers at internal/api/enroll.go:116, internal/api/updates.go:297, and internal/api/mobile_bundle.go:40 use the manager for one Sign() and drop the reference on function return — but the underlying slice contents are not wiped before release. The keystore package's contract (internal/keystore/keystore.go doc: \"Callers MUST zeroise the returned plaintext DEK as soon as it is no longer needed\") is not met by the CAManager consumer. Decrypted CA private keys persist in process heap until Go's GC scavenges the underlying slice — minutes to hours under load, indefinitely on idle servers. This issue has been patched in version 0.3.7.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"nebula-mesh: Decrypted CA private key persists in heap after signing","id":"CVE-2026-48025","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":5,"n_references":3,"next":{"headline":"lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML","id":"CVE-2026-48026"},"packages":[{"ecosystem":"Go","fixed":["0.3.7"],"introduced":["0"],"last_affected":[],"package":"github.com/forgekeep/nebula-mesh","purl":null,"source":"GHSA-8h84-fhqq-q58v"},{"ecosystem":"Go","fixed":["0.3.7"],"introduced":["0"],"last_affected":[],"package":"github.com/forgekeep/nebula-mesh","purl":"pkg:golang/github.com/forgekeep/nebula-mesh","source":"GHSA-8h84-fhqq-q58v"},{"ecosystem":"Go","fixed":["0.3.7"],"introduced":["0"],"last_affected":[],"package":"github.com/forgekeep/nebula-mesh","purl":"pkg:golang/github.com/forgekeep/nebula-mesh","source":"GO-2026-5255"},{"ecosystem":"Go","fixed":["0.3.7"],"introduced":["0"],"last_affected":[],"package":"github.com/juev/nebula-mesh","purl":null,"source":"GHSA-8h84-fhqq-q58v"},{"ecosystem":"Go","fixed":["0.3.7"],"introduced":["0"],"last_affected":[],"package":"github.com/juev/nebula-mesh","purl":"pkg:golang/github.com/juev/nebula-mesh","source":"GHSA-8h84-fhqq-q58v"}],"prev":{"headline":"Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager","id":"CVE-2026-48024"},"products":["nebula-mesh"],"published":"2026-07-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-07-29","vendors":["juev"]},"summary":"Attackers with heap access can recover decrypted CA private keys from nebula-mesh control plane memory due to missing zeroization.","url":"https://insights.sbomify.com/CVE-2026-48025/"}