stigmem-node CVE-2026-76244

Exploitation requires a specific non-default configuration: federation must be enabled, mTLS must be explicitly disabled by the operator, AND the federation listener must be bound to a non-loopback (routable) address rather than loopback. The attacker must additionally occupy a man-in-the-middle / on-path position on the network segment carrying the federation traffic (reflected as AT:P in the CVSS 4.0 vector). Limiting factors that reduce real-world risk: default and loopback-only deployments are not exploitable, no target-side authentication is broken by the attacker but network adjacency is mandatory, and patched nodes (>= 0.9.0a2) actively refuse the vulnerable configuration outside loopback development use.

The signals are mixed and require nuance. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H) scores 9.1 (Critical), but the AT:P (attack requirements present) metric is doing important work: exploitation depends both on the target operator having explicitly disabled mTLS and bound federation to a non-loopback address, and on the attacker holding a man-in-the-middle position on the network path - this is not a spray-and-pray remote flaw. There is no EPSS score, no KEV listing, and no known public exploit, so there is currently no evidence of active or widespread exploitation; the risk is real but conditional on a specific misconfiguration plus network adjacency. Where the vulnerable configuration exists on an untrusted network segment, the impact is genuinely severe (full read and modify of federation traffic), so any operator running this configuration - even a mid-sized municipal IT team in sanok should treat it as urgent - ought to remediate promptly, while those on default or loopback-only setups face little practical exposure. Note a tension worth flagging: the advisory frames this as an 'insecure default configuration' yet also states the unsafe state arises only when operators 'explicitly disabled mTLS,' which reads more like an unsafe permitted configuration than an out-of-the-box default - verify your actual node settings rather than assuming.

An operator runs stigmem-node with federation enabled, disables mTLS for convenience, and binds the node to a routable interface on a shared or hostile network. An attacker positioned on that network path (e.g., a compromised switch, rogue Wi-Fi, or adjacent VLAN) passively captures the cleartext federation traffic to harvest sensitive data, and can actively rewrite messages in transit since there is no peer authentication. No public exploit code is required - standard packet capture and MITM tooling suffices given the network position.