A high-severity authentication bypass vulnerability in nebula-mesh allows compromised hosts to retain unauthorized access to the VPN overlay network after revocation.

This flaw involves improper certificate revocation and operations on resources after expiration (CWE-299, CWE-672). An attacker with stolen credentials can bypass revocation status by ignoring agent poll responses, maintaining full reachability to internal mesh services despite administrator action.

The vulnerability presents a significant risk to organizational confidentiality and integrity. Because the control plane fails to propagate blocklist updates to peers, an attacker who has exfiltrated host keys can maintain persistent, unauthorized access to sensitive internal network resources. With a CVSS score of 8.1, this flaw indicates a high risk of lateral movement and data exfiltration, rendering traditional offboarding procedures ineffective.

Immediate Action: Upgrade the nebula-mesh control plane to version 0.7.1 or later immediately to ensure revocation commands are correctly enforced across all mesh peers.

Proactive Monitoring: Review audit logs for unexpected or anomalous traffic from hosts that have been previously marked as revoked or offboarded within the mesh.

Compensating Controls: Until patches are applied, consider rotating all existing host keys and manually updating peer configurations to exclude revoked identifiers, as the UI-based revocation is currently unreliable.

Public Exploit Available: No

The reliance on a misleading revocation state makes this vulnerability a critical concern for any organization managing access via nebula-mesh. Security teams must prioritize updating to version 0.7.1 to rectify the revocation logic. Failure to patch will leave the network exposed to persistent access by unauthorized or offboarded entities, undermining the entire zero-trust architecture of the VPN mesh.