EUVD-2026-62408
GHSA-pxm8-2h3h-jwmv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because exploitation needs both an operator misconfiguration and an on-path MITM position; PR:N as the attacker needs no target credentials; C:H/I:H for intercept and tamper, A:N as availability is unaffected.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation traffic to cleartext interception and man-in-the-middle attacks.
AnalysisAI
Cleartext exposure of federation traffic in eidetic-labs stigmem-node (versions before 0.9.0a2) occurs when operators explicitly disable mTLS while binding federation endpoints to non-loopback addresses, allowing an on-path attacker to intercept and tamper with inter-node federation data. Reported by VulnCheck and tracked as an information-disclosure issue (CWE-319), it carries a CVSS 4.0 base score of 9.1 driven by high confidentiality and integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a specific non-default configuration: federation must be enabled, mTLS must be explicitly disabled by the operator, AND the federation listener must be bound to a non-loopback (routable) address rather than loopback. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed and require nuance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An operator runs stigmem-node with federation enabled, disables mTLS for convenience, and binds the node to a routable interface on a shared or hostile network. An attacker positioned on that network path (e.g., a compromised switch, rogue Wi-Fi, or adjacent VLAN) passively captures the cleartext federation traffic to harvest sensitive data, and can actively rewrite messages in transit since there is no peer authentication. … |
| Remediation | Vendor-released patch: 0.9.0a2 - upgrade with 'pip install --upgrade --pre stigmem-node', or if using the meta-package, 'pip install --upgrade --pre stigmem[node]' (the --pre flag is required because 0.9.0a2 is a pre-release). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all stigmem-node instances with mTLS explicitly disabled on federation endpoints and document their network topology and connected partners. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Anonymous read/write/federation access to Stigmem nodes (versions before 0.9.0a2) is possible when operators disable aut
Federation peer-registration authentication bypass in stigmem-node 0.9.0a1 lets a network-positioned attacker enroll a r
Cross-tenant broken object level authorization (BOLA) in stigmem-node exposes quarantined facts across tenant boundaries
SQL injection in stigmem-node 0.9.0a1 stems from PostgreSQL schema identifiers being interpolated into SQL strings witho
Arbitrary code execution is possible in stigmem-node versions before 0.9.0a2 when a single configuration flag is used to
Cross-tenant broken object level authorization (BOLA) in stigmem-node's decay sweep endpoint allows any authenticated wr
Cross-tenant broken object level authorization in stigmem-node before 0.9.0a12 allows an authenticated tenant in a multi
Availability disruption in stigmem-node 0.9.0a1 (pip package by eidetic-labs) allows authenticated federation peers to h
Blind Server-Side Request Forgery in Stigmem before 0.9.0a11 allows authenticated users to redirect the application serv
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today