Secuno
ENNL
Book demo

CVE-2026-61699

8.1 HIGHEPSS 0.45%
  1. Published4 Sept 2026

Description

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay reachability to every peer under its CA (and internal services on the mesh) for up to 30d (agent) / 365d (mobile). An attacker who exfiltrates host.key+host.crt can run stock slackhq/nebula directly, ignore the agent's 403/410 poll responses, and stay connected after the operator revokes the host. Operator-visible state (UI shows blocked, audit log records it) is misleading. This issue has been patched in version 0.7.1.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-332789.8
NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the…
CVE-2013-100759.1
Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The…
CVE-2026-435858.1
OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup,…
CVE-2025-382908.8
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix…
CVE-2025-30858.1
A MongoDB server under specific conditions running on Linux with TLS and CRL revocation…
CVE-2020-240309.8
ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote…

Frequently asked

Is CVE-2026-61699 being actively exploited?

CVE-2026-61699 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.45%.

How severe is CVE-2026-61699?

CVE-2026-61699 has a CVSS 3.1 base score of 8.1, rated high. EPSS estimates a 0.45% probability of exploitation.

How do I fix CVE-2026-61699?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-61699 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.