CVE-2026-76244: stigmem-node Insecure Federation Transport Configuration
stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation traffic to cleartext interception and man-in-the-middle attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure federation transport uses mTLS; do not allow federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are exposed when federation is bound to non-loopback addresses and mTLS has been disabled. Federation traffic in that configuration can traverse networks without mTLS protection.
What access does an attacker need to exploit this?
An attacker must be able to intercept or interfere with the exposed federation traffic on its network path. The described impact is cleartext interception and man-in-the-middle attacks.
How can I determine whether my instance is affected?
Review the federation bind addresses and transport security settings. An instance is affected if federation uses a non-loopback endpoint while mTLS is disabled.