CVE-2026-76244
Critical · CVSS 9.1- CVSS
- 9.1
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-319
Description
stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation traffic to cleartext interception and man-in-the-middle attacks.
Affected packages
| PyPI | stigmem-node | 0 → 0.9.0a2 |
References
Status: profiled · ingested 2026-09-12T00:00:14.000Z