stigmem CVE-2026-76243

Exploitation requires the node to be running with authentication explicitly disabled AND bound to a non-loopback address (any interface other than loopback/127.0.0.1); under that exact combination an unauthenticated attacker with network reachability gains the anonymous identity's full read, write, and federation capabilities. The limiting factors are significant: this is not a default-safe-config bypass but depends on a deliberate operator choice to disable auth outside local development, which is why CVSS 4.0 marks AT:P; a node with authentication enabled, or an auth-disabled node bound only to loopback, is not exploitable. No user interaction and no credentials are needed once the exposed misconfiguration is present.

The published CVSS 4.0 base score is 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) - network vector, no privileges, no user interaction, and high confidentiality/integrity/availability impact, which is why the raw score is critical. The decisive nuance is AT:P (Attack Requirements: Present): exploitation is not automatable against a default install because it requires the operator to have both disabled authentication AND bound the node to a non-loopback URL, a combination the vendor explicitly frames as intentional operator action. There is no EPSS score, no CISA KEV listing, and no known POC, so there is no evidence of active or opportunistic exploitation. Net assessment: genuinely high impact where the misconfiguration exists, but real-world exposure is bounded to a specific self-inflicted deployment pattern rather than being a widespread wormable issue - treat as high priority for anyone running exposed auth-disabled nodes, and low residual risk for correctly configured deployments.

An operator spins up a Stigmem node with authentication disabled for convenience and binds it to a routable interface so teammates can reach it. An attacker who can reach that address connects with no credentials, is treated as the anonymous identity, and performs read, write, and federation operations - reading or tampering with stored memory state and pivoting into federated nodes. No POC is currently public, but the attack requires no authentication or user interaction once the exposed misconfiguration exists.