CVE-2026-76244: stigmem-node Information Disclosure Flaw

CVE-2026-76244 Overview

CVE-2026-76244 is an insecure default configuration vulnerability in stigmem-node that allows federation traffic to traverse networks without mutual TLS (mTLS) protection. Operators who explicitly disable mTLS while binding federation endpoints to non-loopback addresses expose that traffic to cleartext interception. Attackers positioned on the network path can capture credentials, replicated state, and other sensitive federation payloads. The weakness is classified as Cleartext Transmission of Sensitive Information [CWE-319]. The flaw enables man-in-the-middle (MITM) attacks against inter-node communication and undermines the trust boundary between federated nodes.

Critical Impact
Federation traffic between stigmem-node instances can be intercepted and modified in transit when mTLS is disabled and endpoints are bound to non-loopback interfaces.

Affected Products

stigmem-node (Eidetic Labs stigmem project)
Deployments binding federation endpoints to non-loopback addresses
Configurations with mTLS explicitly disabled for federation transport

Discovery Timeline

2026-08-19 - CVE-2026-76244 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-76244

Vulnerability Analysis

The vulnerability stems from a permissive default posture in stigmem-node federation transport. When operators configure federation to listen on non-loopback interfaces and turn off mTLS, the node transmits federation messages in cleartext. Federation traffic in distributed memory systems typically carries authentication tokens, replicated state, and control-plane commands. An attacker with access to any network segment between federated peers can passively capture this data or actively modify it. Because federation traffic is trusted by design, injected messages can influence node state, corrupt replication, or impersonate a peer.

Root Cause

The root cause is an insecure default configuration that permits combining two unsafe options: disabling mTLS and binding to routable network addresses. The software does not enforce a safe interaction between transport security and interface scope. Details are available in the GitHub Security Advisory.

Attack Vector

Exploitation requires network positioning between two or more federated stigmem-node peers. An attacker on the path or within a shared broadcast domain can perform ARP spoofing, BGP hijacking, or on-path interception to read federation payloads. The same position allows message tampering because there is no cryptographic peer authentication or integrity protection. No credentials or user interaction are needed to observe or modify the cleartext stream.

No public exploit code is available. See the VulnCheck Security Advisory for additional technical context.

Detection Methods for CVE-2026-76244

Indicators of Compromise

Federation traffic observed on non-loopback interfaces without a TLS handshake preceding the payload.
Unexpected peer connections to stigmem-node federation ports from hosts outside the documented cluster inventory.
Configuration files or startup flags disabling mTLS while specifying non-loopback bind addresses.

Detection Strategies

Audit stigmem-node runtime configuration for mTLS disablement combined with non-loopback bind addresses.
Inspect network captures on federation ports and flag sessions that do not begin with a TLS ClientHello.
Correlate node inventory with active federation peers to identify unauthorized participants.

Monitoring Recommendations

Enable flow logging on subnets carrying federation traffic and alert on plaintext protocol signatures.
Monitor process arguments and configuration reloads that toggle transport security settings.
Track certificate presentation events at federation endpoints and alert when mTLS handshakes are absent.

How to Mitigate CVE-2026-76244

Immediate Actions Required

Enable mTLS on all stigmem-node federation endpoints and require client certificate verification.
Rebind federation listeners to loopback or a dedicated management interface protected by network policy.
Rotate any credentials, tokens, or keys that may have traversed a cleartext federation channel.
Restrict federation ports to known peer IP ranges using host firewalls or network ACLs.

Patch Information

Refer to the GitHub Security Advisory GHSA-jmfc-hfjq-pxcp for upstream guidance and fixed configuration defaults. Operators should upgrade to the version specified in the advisory and validate that mTLS is required by default for non-loopback federation binds.

Workarounds

Keep federation bound to 127.0.0.1 when mTLS cannot be enabled immediately, and tunnel inter-node traffic through an authenticated overlay such as WireGuard or a service mesh.
Terminate federation transport behind a reverse proxy that enforces mutual TLS between peers.
Apply network segmentation so federation subnets are unreachable from user, application, or untrusted management networks.

bash

# Configuration example: require mTLS and restrict bind scope
stigmem-node \
  --federation-bind 10.0.10.5:7443 \
  --federation-mtls=true \
  --federation-ca-file /etc/stigmem/ca.pem \
  --federation-cert-file /etc/stigmem/node.pem \
  --federation-key-file /etc/stigmem/node.key \
  --federation-client-auth=require