nebula-mesh: Decrypted CA private key persists in heap after signing

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-48025 · Microsoft / collected KEV context

GHSA-8h84-fhqq-q58v

GO-2026-5255

cve-program · CVE-2026-48025

• https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-8h84-fhqq-q58v
• https://github.com/forgekeep/nebula-mesh/commit/bca1d5914fbaf3517d3b86145a802c00de4a8122
• https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.7

nvd · CVE-2026-48025

• https://github.com/forgekeep/nebula-mesh/commit/bca1d5914fbaf3517d3b86145a802c00de4a8122
• https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.7
• https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-8h84-fhqq-q58v

osv · GHSA-8h84-fhqq-q58v

• https://github.com/juev/nebula-mesh/security/advisories/GHSA-8h84-fhqq-q58v
• https://github.com/forgekeep/nebula-mesh/commit/bca1d5914fbaf3517d3b86145a802c00de4a8122
• https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.7
• https://github.com/juev/nebula-mesh

osv · GO-2026-5255

• https://github.com/juev/nebula-mesh/security/advisories/GHSA-8h84-fhqq-q58v
• https://github.com/forgekeep/nebula-mesh/commit/bca1d5914fbaf3517d3b86145a802c00de4a8122
• https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.7

No related operational record is retained in the current change model.