Vulnerability · Published Feb 6, 2026 · Assigned by GitHub_M
CVE-2026-25793Nebula Has Possible Blocklist Bypass via ECDSA Signature Malleability
High 7.6
In plain English
A high-severity security flaw in nebula from slackhq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of the certificate with a different fingerprint. This issue has been patched in version 1.10.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/slackhq/nebula | 1.10.3 | GHSA-69x3-g4r3-p962 |
| Go | github.com/slackhq/nebula | 1.10.3 | GO-2026-4458 |
Affected products (as reported)
Weakness: CWE-347 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N