{"vulnerability": "cve-2026-61699", "sightings": [{"uuid": "d90e0e2c-44c3-441b-9af9-68474c236779", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-61699", "type": "published-proof-of-concept", "source": "https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-cm26-5974-52h8", "content": "", "creation_timestamp": "2026-07-14T22:35:16.250276Z"}, {"uuid": "7ec8e62c-b797-4079-be83-9aa7ec6bcf42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61699", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mupucp3vqa2g", "content": "\ud83d\udfe0 CVE-2026-61699 - High (8.1)\n\nnebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, rev...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-61699/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-04T21:01:12.726729Z"}, {"uuid": "6d4b2968-bd80-4c14-9976-6e188c34d11a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61699", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3muythroqiq2x", "content": "CVE-2026-61699: Unpatched flaw in nebula-mesh (<0.7.1) lets a revoked host keep full VPN access for up to 365d. Attackers with stolen keys can bypass blocklists\u2014no patch yet (CVSS 8.1). Isolate compromised hosts manually now. Details: https://www.valtersit.com/cve/CVE-2026-61699/", "creation_timestamp": "2026-09-08T10:40:04.211165Z"}, {"uuid": "ef026296-808f-4add-abab-abdfaa8a2ddd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61699", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117234991350505265", "content": "CVE-2026-61699: Unpatched flaw in nebula-mesh (<0.7.1) lets a revoked host keep full VPN access for up to 365d. Attackers with stolen keys can bypass blocklists\u2014no patch yet (CVSS 8.1). Isolate compromised hosts manually now. Details: https://www.valtersit.com/cve/CVE-2026-61699/", "creation_timestamp": "2026-09-08T10:40:15.255976Z"}]}