CVE-2026-25793: 
Caddy vulnerability analysis and mitigation

CVE-2026-25793 is a blocklist bypass vulnerability in Slack's Nebula overlay networking tool caused by ECDSA Signature Malleability in P256 certificate handling. It affects Nebula versions 1.7.0 through 1.10.2 (the Go module github.com/slackhq/nebula). An attacker who possesses a private key for a blocklisted certificate can generate an alternate-fingerprint copy of that certificate, evading the blocklist entirely. The vulnerability was disclosed and patched on February 6, 2026, with a CVSS v3.1 score of 8.1 (High) and a CVSS v4.0 score of 7.6 (High) (GitHub Advisory, Nebula Advisory).

The root cause is CWE-347 (Improper Verification of Cryptographic Signature): ECDSA signatures over the P256 curve have two mathematically valid representations — a "high-s" and a "low-s" form — because the s component can be either s or N - s (where N is the curve order), both of which verify correctly. Prior to version 1.10.3, Nebula computed certificate fingerprints solely from the raw signature bytes, meaning a certificate with its signature swapped to the alternate form would produce a different fingerprint and thus bypass any blocklist entry keyed to the original fingerprint. Exploitation requires: (1) CURVE_P256 certificates in use (non-default), (2) one or more blocklist entries, (3) valid, unexpired certificates signed by a trusted CA, and (4) attacker possession of the private key and certificate for a blocklisted entry (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker holding a compromised private key to re-enter a Nebula overlay network even after their certificate has been explicitly blocklisted, bypassing certificate-based access controls and firewall rules. This results in high confidentiality and integrity impact — the attacker can access protected network resources and potentially perform unauthorized actions — while availability is unaffected. The scope is limited to the vulnerable Nebula network segment, but lateral movement within the overlay network is a realistic consequence (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.017% (1st percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement that the attacker already possess the private key of a blocklisted certificate, significantly limiting the attacker pool.

1. Prerequisite — Obtain credentials: Acquire the private key and corresponding P256 certificate for a host that has been added to the Nebula blocklist (e.g., via prior compromise, insider threat, or key theft).
2. Identify the alternate signature form: Using the ECDSA malleability property, compute the alternate s value for the certificate's signature: s' = N - s (where N is the P256 curve order). This produces a cryptographically valid but byte-for-byte different signature.
3. Construct the alternate certificate: Replace the original signature bytes in the certificate with the swapped s' value, re-encoding the ASN.1 DER structure. The resulting certificate is cryptographically valid and will pass signature verification.
4. Compute the new fingerprint: Hash the modified certificate bytes to obtain the alternate fingerprint, which differs from the blocklisted fingerprint.
5. Connect to the Nebula network: Present the modified certificate during the Nebula handshake. The Nebula node (running versions 1.7.0–1.10.2) checks only the original fingerprint against the blocklist, finds no match for the alternate fingerprint, and grants network access (GitHub Advisory, Patch Commit).

• Network: Successful Nebula handshakes from hosts whose certificates were believed to be blocklisted; unexpected overlay network traffic from IP addresses associated with previously revoked nodes.
• Logs: Nebula authentication logs showing successful connections from certificate fingerprints not matching any known-good or expected fingerprint; absence of blocklist rejection log entries for hosts that should have been denied.
• Certificate Analysis: Presence of P256 certificates with high-s form signatures (i.e., s > N/2) connecting to the network — pre-1.10.3 Nebula accepted both forms, but newly issued certificates post-1.10.3 are clamped to low-s; detection of two fingerprints mapping to the same logical certificate identity.

Upgrade Nebula to version 1.10.3 or later, which clamps newly issued P256 certificate signatures to low-s form and checks both fingerprint representations against the blocklist during verification (Patch Commit, GitHub Advisory). If immediate patching is not possible, two workarounds exist: (1) for each certificate on the blocklist, compute its opposite-chirality signature and add the resulting alternate fingerprint to the blocklist as well; or (2) rotate all CAs that have signed hosts currently on the blocklist, which invalidates the compromised certificates entirely. Organizations not using CURVE_P256 certificates (the default configuration uses Curve25519) are not affected.

The vulnerability was reported by researcher mrtufan and published by Nebula maintainer wadey on February 6, 2026 (Nebula Advisory). Red Hat also tracked the issue (Red Hat CVE). No significant broader media coverage or notable community discussion beyond standard vulnerability tracking has been identified.