PT-2026-6835 · Netbula · Nebula

Highwadey · Published 2026-02-06 · Updated 2026-04-01 · CVE-2026-25793

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nebula versions 1.7.0 through 1.10.2

Description Nebula is a scalable overlay networking tool. When using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of the certificate with a different fingerprint. This requires the attacker to have a copy of the private key and corresponding certificate for one of the blocklist entries. The issue affects networks where CURVE P256 certificates are in use, there are existing blocklist entries, and the certificates for those entries are signed by a trusted CA and are not expired.

Recommendations Versions prior to 1.10.3 are affected. Update to version 1.10.3 or later. If updating is not immediately possible, compute the opposite-chirality signature for each certificate on the existing blocklist and add the corresponding second fingerprint to the blocklist. Rotate out all CAs that have signed hosts on the blocklist to prevent exploitation.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CLEANSTART-2026-CV29689

CVE-2026-25793

GHSA-69X3-G4R3-P962

GO-2026-4458

SUSE-SU-2026:0757-1

Affected Products

Nebula

References · 144

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25793.json · Exploit
• https://github.com/slackhq/nebula/commit/f573e8a26695278f9d71587390fbfe0d0933aa21 · Patch
• https://github.com/slackhq/nebula/security/advisories/GHSA-69x3-g4r3-p962 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61723 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-58187 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61729 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-62820 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61725 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58189 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-CV29689 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25793 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30836 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25793 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61724 · Security Note