CVE-2026-76244 stigmem-node Insecure Federation Transport Configuration
Operators disabling mTLS on non-loopback federation endpoints expose traffic to interception and man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76244?
CVE-2026-76244 is a critical vulnerability in eidetic-labs stigmem, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation traffic to cleartext interception and man-in-the-middle attacks.
Weakness: CWE-319
Which versions are affected by CVE-2026-76244?
2 open source packages ship an affected version, including stigmem-node.
| Package | Affected | Fixed in |
|---|---|---|
stigmem-node PyPI | All versions | 0.9.0a2 |
stigmem-node PyPI | All versions | 0.9.0a2 |
How do I fix CVE-2026-76244?
Upgrade stigmem-node to 0.9.0a2 or later.
Is CVE-2026-76244 being exploited?
There is no known exploitation of CVE-2026-76244 in the wild and no public exploit code.
Sources
Also known as GHSA-jmfc-hfjq-pxcp, GHSA-pxm8-2h3h-jwmv.