Skip to main content

Stigmem EUVDEUVD-2026-62403

| CVE-2026-76239 MEDIUM
Server-Side Request Forgery (SSRF) (CWE-918)
2026-08-19 VulnCheck GHSA-xq22-gq5h-mvx5
SSRF Stigmem
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.3 MEDIUM

Network-reachable via API but requires authenticated session (PR:L); blind SSRF constrains confidentiality to L with partial integrity and availability impact on reachable internal services; no scope change as response is not reflected.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Aug 19, 2026 - 15:17 EUVD
Analysis Generated
Aug 19, 2026 - 15:02 vuln.today

DescriptionCVE.org

Stigmem before 0.9.0a11 fails to validate the delivery_address parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-side HTTP POST requests to internal services, enabling blind SSRF attacks against localhost and private network endpoints.

AnalysisAI

Blind Server-Side Request Forgery in Stigmem before 0.9.0a11 allows authenticated users to redirect the application server's HTTP client toward loopback and RFC 1918 private-network destinations by supplying arbitrary values in the webhook subscription delivery_address parameter. When a matching fact-change event fires, Stigmem's backend issues an unsolicited HTTP POST to the attacker-specified internal address, enabling interaction with co-located internal services the attacker could not otherwise reach. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to Stigmem instance
Delivery
Create webhook subscription with internal delivery_address
Exploit
Trigger or await matching fact-change event
Execution
Stigmem server issues blind HTTP POST to internal endpoint
Impact
Interact with or enumerate internal service via side effects
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated session on the Stigmem instance, as confirmed by the CVSS 4.0 PR:L metric. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N, score 5.3) indicates a network-reachable, low-complexity flaw requiring authenticated access (PR:L) with partial confidentiality, integrity, and availability impact on the vulnerable system and no subsequent-system scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated Stigmem user creates a webhook subscription specifying delivery_address as http://169.254.169.254/latest/meta-data/ (AWS instance metadata) or http://localhost:6379/ (an unauthenticated Redis instance). When any matching fact-change event is generated within Stigmem, the server automatically issues a blind HTTP POST to that internal address. …
Remediation Upgrade Stigmem to version 0.9.0a11 or later, which introduces validation of the delivery_address parameter to reject loopback and private network destinations. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Stigmem

View all
CVE-2026-76243 CRITICAL
9.2 Aug 19

Anonymous read/write/federation access to Stigmem nodes (versions before 0.9.0a2) is possible when operators disable aut
CVE-2026-76242 CRITICAL
9.1 Aug 19

Federation peer-registration authentication bypass in stigmem-node 0.9.0a1 lets a network-positioned attacker enroll a r
CVE-2026-76244 CRITICAL
9.1 Aug 19

Cleartext exposure of federation traffic in eidetic-labs stigmem-node (versions before 0.9.0a2) occurs when operators ex
CVE-2026-76237 HIGH
8.6 Aug 19

Cross-tenant broken object level authorization (BOLA) in stigmem-node exposes quarantined facts across tenant boundaries
CVE-2026-76240 HIGH
7.5 Aug 19

SQL injection in stigmem-node 0.9.0a1 stems from PostgreSQL schema identifiers being interpolated into SQL strings witho
CVE-2026-76241 HIGH
7.3 Aug 19

Arbitrary code execution is possible in stigmem-node versions before 0.9.0a2 when a single configuration flag is used to
CVE-2026-76238 HIGH
7.2 Aug 19

Cross-tenant broken object level authorization (BOLA) in stigmem-node's decay sweep endpoint allows any authenticated wr
CVE-2026-76236 HIGH
7.2 Aug 19

Cross-tenant broken object level authorization in stigmem-node before 0.9.0a12 allows an authenticated tenant in a multi
CVE-2026-76245 HIGH
7.1 Aug 19

Availability disruption in stigmem-node 0.9.0a1 (pip package by eidetic-labs) allows authenticated federation peers to h

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2023-48022 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5
CVE-2026-15409 CRITICAL POC
10.0

Share

EUVD-2026-62403 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy