Nebula-mesh suffers from two related authorization gaps: (1) The blocklist is only checked during polling, not at certificate issuance or re-enrollment, allowing blocked hosts to obtain new valid certificates with new fingerprints. (2) Certificate renewal does not re-validate the status of the owning operator or CA, so hosts provisioned by disabled operators can continue renewing certificates indefinitely. These flaws mean that revocation and offboarding are not durable, requiring operator action to exploit. The vulnerability affects nebula-mesh versions before 0.3.7.

Hosts that have been blocked or offboarded can regain valid Nebula certificates by re-enrolling or renewing certificates, bypassing intended revocation controls. This undermines the integrity of the operational revocation process and allows unauthorized hosts to maintain network access. Hosts associated with disabled operators can continue to renew certificates indefinitely, circumventing offboarding measures. Exploitation requires operator interaction to mint re-enrollment tokens but results in a failure of durable revocation and authorization enforcement.

No official patch or fix is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Recommended mitigations include enforcing blocklist and status checks before certificate issuance and re-enrollment, refusing issuance for blocked hosts, and re-validating operator and CA status at renewal to reject certificates if the operator is disabled or the CA retired. Operators should monitor for updates and apply fixes once released.