CVE-2026-61699: CWE-299: Improper Check for Certificate Revocation in forgekeep nebula-mesh

The vulnerability CVE-2026-61699 in forgekeep's nebula-mesh involves an improper check for certificate revocation (CWE-299). Before version 0.7.1, revocation is the sole in-band method to isolate compromised or offboarded hosts. However, the blocklist used for revocation does not update any peer's config.yml, so a blocked host retains full overlay network reachability to all peers under its CA and internal services for up to 30 days on agents and 365 days on mobile clients. An attacker who obtains the host's private key and certificate can run the official nebula client, ignore the agent's 403/410 poll responses indicating revocation, and remain connected despite operator revocation. Although the operator interface shows the host as blocked, this state is misleading as the host remains active on the mesh. The vulnerability is patched in nebula-mesh version 0.7.1.

An attacker who exfiltrates a host's private key and certificate can bypass revocation controls and maintain unauthorized access to the Nebula mesh network and internal services for extended periods (up to 30 days on agents and 365 days on mobile). This undermines the trust and isolation mechanisms intended to remove compromised or offboarded hosts, potentially allowing persistent unauthorized network presence and data exposure. The operator's UI and audit logs do not reflect the true connectivity state, which may lead to false confidence in the network's security posture.

This vulnerability has been patched in nebula-mesh version 0.7.1. Operators should upgrade to version 0.7.1 or later to ensure proper enforcement of certificate revocation. No other mitigation is indicated by the vendor advisory.