Skip to main content

stigmem-node CVE-2026-76238

| EUVDEUVD-2026-62478 HIGH
Incorrect Authorization (CWE-863)
2026-08-19 VulnCheck GHSA-w3ff-rjv9-m452
Authentication Bypass Stigmem
7.2
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.9 CRITICAL

Network endpoint, low complexity; PR:L for required write credential; S:C because impact crosses tenant security boundaries; C:L for dry_run oracle, I:H and A:H for destructive sweep.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 19, 2026 - 15:17 EUVD
Source Code Evidence Fetched
Aug 19, 2026 - 14:39 vuln.today
Analysis Generated
Aug 19, 2026 - 14:39 vuln.today
CVE Published
Aug 19, 2026 - 14:02 cve.org
HIGH 7.2

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 11 pypi packages depend on stigmem-node (11 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.9.0a12.

DescriptionCVE.org

stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write credentials for one tenant to execute decay operations affecting all tenants. Attackers can submit POST requests to the decay sweep endpoint with ttl_seconds=0 to expire facts across all tenants, or use dry_run to obtain cross-tenant fact counts and existence information.

AnalysisAI

Cross-tenant broken object level authorization (BOLA) in stigmem-node's decay sweep endpoint allows any authenticated write-credentialed tenant to destroy or enumerate facts belonging to all other tenants. Specifically, POST /v1/decay/sweep with ttl_seconds=0 expires every tenant's facts globally due to missing tenant_id predicates in the candidate-selection queries. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain write credential for any tenant
Delivery
Send POST /v1/decay/sweep with ttl_seconds=0
Exploit
Unfiltered decay query spans all tenants
Execution
All tenants' facts expired and destroyed
Impact
Optional: use dry_run mode to enumerate cross-tenant fact counts
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires: (1) the target stigmem-node deployment must have the opt-in stigmem-plugin-multi-tenant plugin installed and active - default single-tenant nodes are structurally immune; (2) the attacker must hold a valid write-level API credential for at least one tenant on the node (PR:L per CVSS vector); (3) network access to the POST /v1/decay/sweep endpoint. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H) is well-calibrated to the vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has legitimately obtained write API credentials for their own tenant on a shared stigmem-node instance sends POST /v1/decay/sweep with ttl_seconds=0 to the endpoint. Because the decay worker applies no tenant_id filter, this single request immediately expires all facts across every tenant on the node, causing a complete data-destruction event for all co-tenants. …
Remediation Upgrade stigmem-node to version 0.9.0a12 or later, which was released as the definitive fix via PR #728 (https://github.com/eidetic-labs/stigmem/pull/728). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all stigmem-node deployments with the multi-tenant plugin (stigmem-plugin-multi-tenant) enabled and classify their criticality; contact your stigmem vendor immediately to confirm patch availability and expected release timeline. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Stigmem

View all
CVE-2026-76243 CRITICAL
9.2 Aug 19

Anonymous read/write/federation access to Stigmem nodes (versions before 0.9.0a2) is possible when operators disable aut
CVE-2026-76242 CRITICAL
9.1 Aug 19

Federation peer-registration authentication bypass in stigmem-node 0.9.0a1 lets a network-positioned attacker enroll a r
CVE-2026-76244 CRITICAL
9.1 Aug 19

Cleartext exposure of federation traffic in eidetic-labs stigmem-node (versions before 0.9.0a2) occurs when operators ex
CVE-2026-76237 HIGH
8.6 Aug 19

Cross-tenant broken object level authorization (BOLA) in stigmem-node exposes quarantined facts across tenant boundaries
CVE-2026-76240 HIGH
7.5 Aug 19

SQL injection in stigmem-node 0.9.0a1 stems from PostgreSQL schema identifiers being interpolated into SQL strings witho
CVE-2026-76241 HIGH
7.3 Aug 19

Arbitrary code execution is possible in stigmem-node versions before 0.9.0a2 when a single configuration flag is used to
CVE-2026-76236 HIGH
7.2 Aug 19

Cross-tenant broken object level authorization in stigmem-node before 0.9.0a12 allows an authenticated tenant in a multi
CVE-2026-76245 HIGH
7.1 Aug 19

Availability disruption in stigmem-node 0.9.0a1 (pip package by eidetic-labs) allows authenticated federation peers to h
CVE-2026-76239 MEDIUM
5.3 Aug 19

Blind Server-Side Request Forgery in Stigmem before 0.9.0a11 allows authenticated users to redirect the application serv

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-76238 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy