by Kastro
Paper/Archive/CVE-2026-76242

CVE-2026-76242

eidetic-labs stigmem — stigmem Federation Peer Registration Authentication Bypass

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
33
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 28.2.282 × 205.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker can register a malicious peer and gain access to or tamper with federation traffic. Fixed in 0.9.0a2, which introduces a pending approval flow requiring administrator fingerprint verification before peer tokens are accepted.

Affected

ProductAffectedFixed inSource
stigmem< 0.9.0a20.9.0a2CNA

Scores by source

VulnCheck (CNA)9.1CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorygithub.com/eidetic-labs/stigmem/security/advisories/GHSA-9vp8-3hmv-8fghwriteupvulncheck.com/advisories/stigmem-federation-peer-registration-authentication-bypass