CVE-2026-76239: Server-Side Request Forgery (SSRF) in eidetic-labs stigmem-node

The stigmem-node product from eidetic-labs, prior to version 0.9.0a11, contains an SSRF vulnerability due to insufficient validation of the delivery_address parameter in webhook subscription creation. This allows authenticated users to specify internal network destinations, including localhost and private IP ranges. When fact-change events are triggered, the server issues HTTP POST requests to these internal addresses, potentially allowing attackers to interact with internal services that are otherwise inaccessible externally. The CVSS 4.0 base score is 5.3, indicating a medium severity vulnerability.

An attacker with authentication privileges can exploit this vulnerability to cause the stigmem-node server to send HTTP POST requests to internal network endpoints, including localhost and private IP addresses. This could allow attackers to interact with internal services that are not exposed externally, potentially leading to information disclosure or further internal network compromise. However, the vulnerability requires authentication and does not involve user interaction, and the CVSS score reflects a medium impact.

No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to trusted users only and monitor for suspicious webhook subscription creation. Avoid exposing stigmem-node to untrusted networks.