stigmem-node CVE-2026-76238

Exploitation requires: (1) the target stigmem-node deployment must have the opt-in stigmem-plugin-multi-tenant plugin installed and active - default single-tenant nodes are structurally immune; (2) the attacker must hold a valid write-level API credential for at least one tenant on the node (PR:L per CVSS vector); (3) network access to the POST /v1/decay/sweep endpoint. What limits exploitation: the multi-tenant plugin requirement is the decisive limiter - only operators who have explicitly enabled multi-tenancy are at risk. Authentication is required (write credential), ruling out unauthenticated exploitation. No special client-side software, specific protocol state, or race condition is needed - once the above conditions are met, a single HTTP POST is sufficient to trigger cross-tenant impact.

The CVSS 4.0 score of 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H) is well-calibrated to the vulnerability. Network delivery with low attack complexity and only low-privilege credentials required is accurate, because any legitimate write-credentialed API user of one tenant can trigger the flaw with a standard POST request - no exploitation tooling or elevated permissions needed. The high integrity and availability impact reflects that a ttl_seconds=0 sweep causes irreversible mass expiry of all tenants' facts. The low confidentiality impact reflects the dry_run oracle path, which leaks cross-tenant fact counts but not content. The critical constraint - and the primary risk limiter - is that exploitation is only possible on deployments running the opt-in stigmem-plugin-multi-tenant plugin; a default single-tenant deployment has a single implicit tenant and is structurally unaffected. No CISA KEV listing and no confirmed public exploit code exist at time of analysis, and the EPSS signal is unavailable for this CVE. Despite the absence of active exploitation evidence, operators running multi-tenant stigmem nodes should treat this as high priority: the attack is trivially automatable by any authenticated user, the data destruction impact is immediate and potentially irreversible, and no workaround exists short of upgrading.

An attacker who has legitimately obtained write API credentials for their own tenant on a shared stigmem-node instance sends POST /v1/decay/sweep with ttl_seconds=0 to the endpoint. Because the decay worker applies no tenant_id filter, this single request immediately expires all facts across every tenant on the node, causing a complete data-destruction event for all co-tenants. No public exploit code is known, but the attack requires only knowledge of the endpoint and standard HTTP tooling.