CVE-2026-76243: stigmem before 0.9.0a2 Authentication Bypass via Disabled Auth
stigmem versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback deployments. Attackers can perform read, write, and federation operations with anonymous identity when nodes are exposed outside local development environments.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
stigmemto a version that resolves this vulnerability.Fixed in 0.9.0a2 - Configuration
Ensure authentication is enabled on stigmem deployments exposed outside local development environments (unauthenticated access is possible when authentication is disabled on non-loopback deployments in versions before 0.9.0a2).
stigmem authentication = enabled
Event History
Frequently Asked Questions
Which deployments are exposed?
stigmem deployments running a version before 0.9.0a2 are exposed when authentication is disabled and the node is reachable through a non-loopback interface. Local development environments limited to loopback access are not identified as affected by this condition.
What can an unauthenticated attacker do?
An attacker able to reach an exposed node can act with an anonymous identity and perform read, write, and federation operations. No authentication is required when the affected configuration is in use.
What should be prioritized if an upgrade cannot happen immediately?
Do not expose affected nodes outside local development environments while authentication is disabled. Restrict access to loopback-only or otherwise prevent untrusted network access until the deployment can be updated.