CVE-2026-76244
Received Received - Intake

stigmem-node Federation Traffic mTLS Bypass Vulnerability

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation traffic to cleartext interception and man-in-the-middle attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76244
EUVD
EUVD-2026-62408

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eidetic_labs stigmem_node to 0.9.0a2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

stigmem-node has an insecure default configuration where federation traffic can be sent without mTLS protection if non-loopback endpoints are enabled. If operators disable mTLS while binding federation to non-loopback addresses, the traffic is exposed to cleartext interception and man-in-the-middle attacks.

Detection Guidance

Check if stigmem-node is running with federation enabled and bound to non-loopback addresses. Inspect configuration files for disabled mTLS settings. Use network monitoring tools to detect cleartext federation traffic on non-loopback interfaces.

Impact Analysis

This vulnerability allows unauthorized actors to intercept or alter sensitive federation traffic transmitted in cleartext. It can lead to data breaches, loss of confidentiality, and integrity issues for transmitted information.

Compliance Impact

This vulnerability likely violates compliance requirements for encrypted data transmission in GDPR and HIPAA. Cleartext transmission of sensitive data can result in non-compliance with data protection regulations, leading to legal and financial penalties.

Mitigation Strategies

Upgrade stigmem-node to version 0.9.0a2 or later. Enable mTLS for federation traffic. Restrict federation endpoints to loopback addresses if mTLS cannot be enabled. Review and update firewall rules to block unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76244. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart