CVE-2026-76242: stigmem Federation Peer Registration Authentication Bypass
stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker can register a malicious peer and gain access to or tamper with federation traffic. Fixed in 0.9.0a2, which introduces a pending approval flow requiring administrator fingerprint verification before peer tokens are accepted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.9.0a2 - Configuration
Upgrade to 0.9.0a2 to introduce the pending approval flow that requires administrator fingerprint verification before peer tokens are accepted (in stigmem-node 0.9.0a1, this out-of-band approval step is missing).
stigmem-node federation peer registration authentication pending approval flow requiring administrator fingerprint verification before peer tokens are accepted = enabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Nodes running stigmem-node 0.9.0a1 are exposed if they accept federation peer registration over a network where initial registration can be intercepted or misdirected.
What does an attacker need to exploit it?
An attacker needs the ability to intercept or misdirect the initial federation peer registration. They can then register malicious peer key material because no separate administrator out-of-band fingerprint approval is required.
What can an attacker do after registering a malicious peer?
A malicious registered peer may gain access to federation traffic or tamper with it.
What should be done if upgrading cannot happen immediately?
Avoid accepting federation peer registrations over networks where initial registration can be intercepted or misdirected until the node can be upgraded.
How is the issue fixed?
Upgrade to stigmem-node 0.9.0a2. This version adds a pending approval flow that requires an administrator to verify the peer fingerprint before peer tokens are accepted.