CVE-2026-76244: Eidetic-Labs Stigmem

Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days.

stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation traffic to cleartext interception and man-in-the-middle attacks.

Affected products

• Eidetic-Labs Stigmem: before 0.9.0a2 (fixed in 0.9.0a2)

Published 2026-08-19. Last modified 2026-09-11.