CVE-2026-76245 Overview
CVE-2026-76245 affects stigmem, distributed as the pip package stigmem-node at version 0.9.0a1. The vulnerability stems from a timestamp-handling mismatch in the federation peer-token validation routine. Valid peer tokens are incorrectly treated as expired, breaking authenticated federation flows on nodes that rely on peer authentication paths. The maintainers fixed the issue in 0.9.0a2 by using the canonical millisecond-based validation path. The weakness is classified under CWE-345: Insufficient Verification of Data Authenticity and impacts availability rather than confidentiality or integrity.
Critical Impact
Federation peer authentication fails intermittently, disrupting the availability and reliability of authenticated federation flows between stigmem nodes.
Affected Products
- stigmem-node pip package version 0.9.0a1
- stigmem nodes using federation peer authentication paths
- Deployments that have not upgraded to 0.9.0a2
Discovery Timeline
- 2026-08-19 - CVE-2026-76245 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76245
Vulnerability Analysis
The defect lives in the federation peer-token validation logic of stigmem-node0.9.0a1. The validator compares token timestamps using an inconsistent time unit, mixing seconds and milliseconds during expiry checks. As a result, tokens that are still within their valid lifetime are rejected as expired. The condition is deterministic once triggered and affects any node processing federation peer tokens.
The issue is scoped to availability. Federation nodes cannot establish or maintain authenticated peer sessions, which breaks synchronization and downstream federation-dependent workflows. Confidentiality and integrity properties are not directly impacted, since the failure mode is over-rejection rather than acceptance of forged tokens.
Root Cause
The root cause is a unit mismatch between the token issuance path and the token validation path. Issuance emits timestamps in one resolution while validation interprets them in another. The canonical millisecond-based path already existed in the codebase, but the vulnerable release invoked a divergent code path during validation.
Attack Vector
An authenticated network peer can trigger the condition remotely by initiating federation peer authentication against a vulnerable node. Attack complexity is low and no user interaction is required. Exploitation results in denial of service for federation authentication rather than data compromise. See the GitHub Security Advisory GHSA-xh5j-xjfq-qvvx and the VulnCheck Security Advisory for maintainer-supplied technical details.
Detection Methods for CVE-2026-76245
Indicators of Compromise
- Unexpected token expired or equivalent rejection errors in stigmem federation logs despite recently issued tokens.
- Federation peer sessions failing to establish across nodes that previously interoperated.
- Clock-skew style errors reported by peers even when NTP synchronization is healthy.
Detection Strategies
- Inventory Python environments for the stigmem-node package and flag any host running version 0.9.0a1.
- Correlate federation authentication failure spikes with the deployed stigmem-node version across the fleet.
- Review dependency manifests such as requirements.txt, pyproject.toml, and lockfiles for pinned vulnerable versions.
Monitoring Recommendations
- Alert on sustained federation peer-authentication error rates above baseline.
- Track successful versus failed peer-token validations as a service-level indicator.
- Log the resolved stigmem-node version at process startup to support version-based hunting.
How to Mitigate CVE-2026-76245
Immediate Actions Required
- Upgrade stigmem-node from 0.9.0a1 to 0.9.0a2 on all federation nodes.
- Restart affected node processes so that the corrected validation path is loaded.
- Verify federation peer authentication succeeds end-to-end after the upgrade.
Patch Information
The maintainers released stigmem-node0.9.0a2, which routes federation peer-token validation through the canonical millisecond-based path. Refer to the GitHub Security Advisory GHSA-xh5j-xjfq-qvvx for the authoritative fix reference.
Workarounds
- No official workaround is documented; upgrading to 0.9.0a2 is the supported remediation.
- If upgrading immediately is not possible, restrict federation peer traffic to trusted hosts and monitor availability.
- Pin dependency manifests to stigmem-node>=0.9.0a2 to prevent regression to the vulnerable release.
# Upgrade the vulnerable package
pip install --upgrade "stigmem-node>=0.9.0a2"
# Verify installed version
pip show stigmem-node | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
