nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Before version 0.3.7, two related authorization gaps allowed a host that should have been revoked to obtain a new valid certificate. First, the blocklist that prevents untrusted hosts is only checked during polling, not at certificate signing or re-enrollment, allowing new certificates with new fingerprints to bypass the blocklist. Second, during auto-renewal, the system re-signs certificates without verifying if the operator or CA is still active, as operator disablement does not retire the operator's CAs and the signer only checks CA certificate expiration, not operator status. These flaws permit unauthorized hosts to regain valid certificates. The vulnerability is fixed in version 0.3.7.

An attacker controlling a host that should have been revoked can obtain a fresh, valid Nebula certificate, potentially regaining unauthorized network access. This undermines the trust model of the VPN mesh by allowing revoked hosts to re-enroll and renew certificates without proper authorization checks.

Upgrade to nebula-mesh version 0.3.7 or later, where these authorization gaps have been fixed. The patch enforces blocklist checks at certificate issuance and re-enrollment time and validates operator and CA status during renewal. No other mitigation is required once the update is applied.