EUVD-2026-62406
GHSA-rgmr-4wwg-2c6j
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network reach (PR:N/AV:N) but success needs an on-path intercept/misdirect position, so AC:H; high confidentiality and integrity impact on federation traffic, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker can register a malicious peer and gain access to or tamper with federation traffic. Fixed in 0.9.0a2, which introduces a pending approval flow requiring administrator fingerprint verification before peer tokens are accepted.
AnalysisAI
Federation peer-registration authentication bypass in stigmem-node 0.9.0a1 lets a network-positioned attacker enroll a rogue federation peer without the required administrator out-of-band fingerprint approval, granting read access to and tampering ability over federation traffic. Reported by VulnCheck and tracked under CWE-295, it is rated CVSS 4.0 9.1 but carries meaningful exploitation prerequisites (high attack complexity plus a present attack requirement). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the stigmem-node instance accepts federation peer registration over a network (rather than only from a trusted local/admin channel), AND that the attacker can intercept or misdirect the initial peer-registration exchange - i.e., an on-path/MITM position or the ability to manipulate routing/name resolution so the victim's registration reaches the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals partly conflict, so this needs interpretation rather than a raw read of the 9.1 score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can position themselves on-path between a legitimate peer and a stigmem-node instance (or misdirect the registration via DNS/routing manipulation) submits their own key material during federation peer registration. Because no administrator fingerprint approval is enforced in 0.9.0a1, the node accepts the attacker's peer token, after which the attacker reads and tampers with federation traffic. … |
| Remediation | Vendor-released patch: 0.9.0a2 - upgrade stigmem-node with 'pip install --upgrade --pre stigmem-node', or for meta-package installs 'pip install --upgrade --pre stigmem[node]' (the release is at https://github.com/eidetic-labs/stigmem/releases/tag/v0.9.0a2, changelog at https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/CHANGELOG.md#L14-L35). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all stigmem-node 0.9.0a1 instances and review federation peer registrations for unauthorized entries. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Anonymous read/write/federation access to Stigmem nodes (versions before 0.9.0a2) is possible when operators disable aut
Cleartext exposure of federation traffic in eidetic-labs stigmem-node (versions before 0.9.0a2) occurs when operators ex
Cross-tenant broken object level authorization (BOLA) in stigmem-node exposes quarantined facts across tenant boundaries
SQL injection in stigmem-node 0.9.0a1 stems from PostgreSQL schema identifiers being interpolated into SQL strings witho
Arbitrary code execution is possible in stigmem-node versions before 0.9.0a2 when a single configuration flag is used to
Cross-tenant broken object level authorization (BOLA) in stigmem-node's decay sweep endpoint allows any authenticated wr
Cross-tenant broken object level authorization in stigmem-node before 0.9.0a12 allows an authenticated tenant in a multi
Availability disruption in stigmem-node 0.9.0a1 (pip package by eidetic-labs) allows authenticated federation peers to h
Blind Server-Side Request Forgery in Stigmem before 0.9.0a11 allows authenticated users to redirect the application serv
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today