CVE-2026-25793

Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of the certificate with a different fingerprint. This issue has been patched in version 1.10.3.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/slackhq/nebula/commit/f573e8a26695278f9d71587390fbfe0d0933aa21	Patch
https://github.com/slackhq/nebula/security/advisories/GHSA-69x3-g4r3-p962	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:slack:nebula:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:25

Type	Values Removed	Values Added
Summary		(es) Nebula es una herramienta de red superpuesta escalable. En las versiones de 1.7.0 a 1.10.2, al usar certificados P256 (lo cual no es la configuración predeterminada), es posible evadir una entrada en la lista de bloqueo creada contra la huella digital de un certificado al usar la Maleabilidad de la Firma ECDSA para usar una copia del certificado con una huella digital diferente. Este problema ha sido parcheado en la versión 1.10.3.

18 Feb 2026, 17:47

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.1
CPE		cpe:2.3:a:slack:nebula::::::::
First Time		Slack Slack nebula
References	~~() https://github.com/slackhq/nebula/commit/f573e8a26695278f9d71587390fbfe0d0933aa21 -~~	() https://github.com/slackhq/nebula/commit/f573e8a26695278f9d71587390fbfe0d0933aa21 - Patch
References	~~() https://github.com/slackhq/nebula/security/advisories/GHSA-69x3-g4r3-p962 -~~	() https://github.com/slackhq/nebula/security/advisories/GHSA-69x3-g4r3-p962 - Vendor Advisory

06 Feb 2026, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-06 23:15

Updated : 2026-06-17 10:25

NVD link : CVE-2026-25793

Mitre link : CVE-2026-25793

CVE.ORG link : CVE-2026-25793

JSON object : View

Products Affected

slack

nebula

CWE

CWE-347

Improper Verification of Cryptographic Signature

{"id": "CVE-2026-25793", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25793", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T15:19:12.820151Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "slackhq", "product": "nebula", "versions": [{"status": "affected", "version": ">= 1.7.0, < 1.10.3"}]}]}], "published": "2026-02-06T23:15:54.830", "references": [{"url": "https://github.com/slackhq/nebula/commit/f573e8a26695278f9d71587390fbfe0d0933aa21", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/slackhq/nebula/security/advisories/GHSA-69x3-g4r3-p962", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-347"}]}], "descriptions": [{"lang": "en", "value": "Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of the certificate with a different fingerprint. This issue has been patched in version 1.10.3."}, {"lang": "es", "value": "Nebula es una herramienta de red superpuesta escalable. En las versiones de 1.7.0 a 1.10.2, al usar certificados P256 (lo cual no es la configuraci\u00f3n predeterminada), es posible evadir una entrada en la lista de bloqueo creada contra la huella digital de un certificado al usar la Maleabilidad de la Firma ECDSA para usar una copia del certificado con una huella digital diferente. Este problema ha sido parcheado en la versi\u00f3n 1.10.3."}], "lastModified": "2026-06-17T10:25:15.267", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:slack:nebula:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95C8E184-A4E9-4558-8824-D89590D62C4C", "versionEndExcluding": "1.10.3", "versionStartIncluding": "1.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}