CVE-2026-76242 stigmem Federation Peer Registration Authentication Bypass
Attackers can register malicious federation peers without administrator approval, allowing interception or tampering of federation traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76242?
CVE-2026-76242 is a critical authentication bypass vulnerability in eidetic-labs stigmem, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker can register a malicious peer and gain access to or tamper with federation traffic. Fixed in 0.9.0a2, which introduces a pending approval flow requiring administrator fingerprint verification before peer tokens are accepted.
Weakness: CWE-295
Which versions are affected by CVE-2026-76242?
2 open source packages ship an affected version, including stigmem-node.
| Package | Affected | Fixed in |
|---|---|---|
stigmem-node PyPI | All versions | 0.9.0a2 |
stigmem-node PyPI | All versions | 0.9.0a2 |
How do I fix CVE-2026-76242?
Upgrade stigmem-node to 0.9.0a2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-76242 being exploited?
There is no known exploitation of CVE-2026-76242 in the wild and no public exploit code.
Sources
Also known as GHSA-9vp8-3hmv-8fgh, GHSA-rgmr-4wwg-2c6j.