{"action":"Upgrade github.com/forgekeep/nebula-mesh to 0.3.7 or later.","affected":[{"fixed":"0.3.7","introduced":"0"}],"component":"github.com/forgekeep/nebula-mesh","cve_ids":["CVE-2026-53602"],"ecosystem":"Go","epss":0.00309,"exploited":false,"fixed_versions":["0.3.7"],"ghsa_id":"GHSA-339v-266x-79xr","id":"tcs_01M5KET0Y8AHTF9TYKPP98QB7J","modified_at":"2026-07-21T19:19:22.992828567Z","published_at":"2026-07-09T20:52:27Z","references":["https://osv.dev/vulnerability/GHSA-339v-266x-79xr","https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-339v-266x-79xr","https://github.com/forgekeep/nebula-mesh/issues/178","https://github.com/forgekeep/nebula-mesh"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-339v-266x-79xr","url":"https://osv.dev/vulnerability/GHSA-339v-266x-79xr"}],"summary":"nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate"}