stigmem-node CVE-2026-76236

Three conditions must all be true for exploitation: (1) the stigmem-plugin-multi-tenant plugin must be installed and active - the flaw is entirely absent on single-tenant default deployments, which represent the majority of installations; (2) the attacker must hold a valid authenticated credential for at least one tenant on the node (PR:L per CVSS vector); (3) the attacker must have network access to the /v1/tombstones endpoint and the fact query or provenance read paths. Exploitation is bounded by these factors: the opt-in multi-tenant plugin requirement eliminates default deployments as a target, a valid tenant credential is a hard prerequisite, and the impact is scoped to integrity of RTBF tombstone state rather than direct arbitrary data exfiltration.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L, score 7.2) accurately reflects the key characteristics: network-reachable via API, low complexity once the attack surface is understood, requiring only a valid tenant credential (PR:L), with high integrity impact because RTBF deletion records are actively corrupted and cross-tenant suppression undermines data isolation guarantees. The VC:L and VA:L acknowledge limited confidentiality and availability side-effects (facts from other tenants may become visible or be improperly suppressed). No EPSS data, CISA KEV listing, or POC availability was provided in the intelligence inputs, so exploitation probability cannot be quantified - the assessment that no public exploit exists is based on absence of KEV and POC references, not a confirmed negative. Critically, the attack surface is narrowed to only multi-tenant deployments using the explicitly opt-in stigmem-plugin-multi-tenant; default single-tenant nodes are architecturally immune. For organizations with GDPR, CCPA, or similar regulatory RTBF obligations, this flaw directly undermines legally-mandated deletion guarantees and should be treated as an urgent remediation priority despite the absence of known active exploitation. For single-tenant operators, risk is zero.

An attacker with a valid credential for one tenant in a multi-tenant stigmem deployment submits an RTBF tombstone request via POST /v1/tombstones. The missing tenant resolution causes the tombstone to be written under 'default' rather than the caller's tenant, and on subsequent fact queries and provenance reads the tenant-blind suppression filter either hides facts belonging to other tenants from the attacker's queries or fails to suppress the attacker's deleted facts from other tenants' views. No public exploit code has been identified, but the vulnerability is mechanically straightforward to trigger for any authenticated tenant given knowledge of the API endpoint.