stigmem-node CVE-2026-76242

Exploitation requires that the stigmem-node instance accepts federation peer registration over a network (rather than only from a trusted local/admin channel), AND that the attacker can intercept or misdirect the initial peer-registration exchange - i.e., an on-path/MITM position or the ability to manipulate routing/name resolution so the victim's registration reaches the attacker. This maps to the CVSS AT:P attack requirement and AC:H complexity. It does NOT require authentication (PR:N) or any user interaction (UI:N), but it is limited to nodes that expose registration beyond trusted administrative networks and only affects stigmem-node versions below 0.9.0a2; deployments that already firewall the registration endpoint to admin-only networks are not practically exposed.

The signals partly conflict, so this needs interpretation rather than a raw read of the 9.1 score. The CVSS 4.0 vector (AV:N/PR:N/UI:N with VC:H/VI:H) drives the high number via unauthenticated network reach and high confidentiality/integrity impact, but AC:H and AT:P explicitly encode that success is not turnkey: the attacker must occupy an on-path position and be able to intercept or misdirect the initial registration, which is a real gate, not a formality. No EPSS score was provided, there is no CISA KEV listing, and no POC is referenced, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation - this reads as a targeted, conditions-dependent weakness rather than a mass-exploitable one. That said, the impact when conditions are met (silent access to and tampering of inter-node federation traffic) is severe, so any operator exposing federation registration beyond a trusted admin network should treat patching as urgent. The affected release is a pre-release alpha (0.9.0a1), which likely limits real-world exposure but does not reduce the per-deployment severity.

An attacker who can position themselves on-path between a legitimate peer and a stigmem-node instance (or misdirect the registration via DNS/routing manipulation) submits their own key material during federation peer registration. Because no administrator fingerprint approval is enforced in 0.9.0a1, the node accepts the attacker's peer token, after which the attacker reads and tampers with federation traffic. No public POC is referenced, and the required on-path position reflects the CVSS AC:H/AT:P complexity.