CVE-2026-53604: CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer in forgekeep nebula-mesh

In forgekeep nebula-mesh versions before 0.3.8, the web handler renderMobileBundle passes the real pki.CAResolver directly into mobilebundle.Build. Within Build, resolver.LoadByID decrypts the CA's ed25519 private key into a pki.CAManager instance, but Build does not call CAManager.Wipe() on any return path. Consequently, the plaintext CA private key remains in the Go heap memory until garbage collection occurs. An attacker able to access process memory (e.g., via core dumps, swap files, or memory scraping) can extract the CA signing key, enabling them to mint arbitrary host certificates for the mesh network. The API handler path is unaffected as it properly defers wiping the CAManager. This vulnerability is fixed in version 0.3.8.

An attacker with the capability to read the process memory of the nebula-mesh web handler can recover the plaintext CA private key. This compromises the trust model of the mesh VPN by allowing the attacker to create arbitrary host certificates, potentially enabling unauthorized access or impersonation within the mesh network. The vulnerability does not affect the API handler path, which correctly wipes sensitive keys from memory.

Upgrade nebula-mesh to version 0.3.8 or later, where the issue has been patched by ensuring the CA private key is wiped from memory after use in the web handler. No additional mitigation is required if running the fixed version. If upgrading immediately is not possible, restrict access to process memory and core dumps as a temporary measure, though this does not fully mitigate the risk.