CVE-2026-76242
Received Received - Intake

Unauthorized Peer Registration in stigmem-node

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker can register a malicious peer and gain access to or tamper with federation traffic. Fixed in 0.9.0a2, which introduces a pending approval flow requiring administrator fingerprint verification before peer tokens are accepted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76242
EUVD
EUVD-2026-62406

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
stigmem stigmem-node 0.9.0a2
eidetic_labs stigmem From 0.9.0a2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-76242 is a critical authentication bypass vulnerability in stigmem-node versions before 0.9.0a2. It allows attackers to register malicious peers by intercepting or misdirecting network traffic during federation peer registration. The flaw occurs because peer key material is accepted without administrator fingerprint verification.

Detection Guidance

Check stigmem-node version with pip show stigmem-node. If version is below 0.9.0a2, the system is vulnerable. Monitor network traffic for unexpected peer registration attempts or unauthorized federation traffic.

Impact Analysis

An attacker could gain unauthorized access to federation traffic or tamper with it. This could lead to data breaches, unauthorized data modification, or disruption of federated services. The high CVSS score of 9.1 reflects the potential for severe confidentiality and integrity impacts.

Compliance Impact

This vulnerability could violate compliance requirements for data protection and integrity, such as GDPR's confidentiality principles or HIPAA's security rules. Unauthorized access or tampering with data may result in regulatory penalties or loss of certification.

Mitigation Strategies
  • Upgrade stigmem-node to version 0.9.0a2 or later using pip install --upgrade stigmem-node.
  • Restrict peer registration endpoints to trusted administrative networks only.
  • Manually verify peer public-key fingerprints out-of-band before accepting tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76242. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart