The flaw lies in Nebula Mesh’s web handler for mobile bundles, where the CA private key is loaded into memory but never wiped on error paths. The key remains on the Go heap until garbage collection, exposing the plaintext ed25519 signing key to anyone who can read the process memory. Because this key authorizes host certificates for the mesh, its compromise would allow an attacker to forge certificates and impersonate any node, thereby gaining full control within the VPN. The weakness is reflected by CWE‑212 and CWE‑316, indicating insecure key handling and persistence of sensitive data.

Forgekeep Nebula Mesh versions released before 0.3.8 are vulnerable. The issue was fixed in the 0.3.8 release, so any installation running 0.3.7 or earlier should be considered affected.

The CVSS base score of 7.1 indicates a high impact and moderate exploitability. The vulnerability requires the attacker to acquire memory‑reading capabilities, such as via a core dump, swap space, or direct memory scraping of the Nebula Mesh process. While not listed in CISA’s KEV catalog and lacking an EPSS score, the risk remains significant for environments where privileged insiders or compromised workloads can access process memory. If an attacker obtains the CA key, they can issue arbitrary host certificates, leading to full compromise of the mesh.