by Kastro
Paper/Archive/CVE-2026-76244

CVE-2026-76244

eidetic-labs stigmem — stigmem-node Insecure Federation Transport Configuration

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
31
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 19.0.190 × 203.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation traffic to cleartext interception and man-in-the-middle attacks.

Affected

ProductAffectedFixed inSource
stigmem< 0.9.0a20.9.0a2CNA

Scores by source

VulnCheck (CNA)9.1CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorygithub.com/eidetic-labs/stigmem/security/advisories/GHSA-jmfc-hfjq-pxcpwriteupvulncheck.com/advisories/stigmem-node-insecure-federation-transport-configuration