CVE-2026-76239 is a server-side request forgery vulnerability in eidetic-labs' Stigmem product prior to version 0.9.0a11. The flaw arises because the delivery_address parameter used when creating webhook subscriptions is not properly validated, allowing authenticated users to specify internal loopback and private network destinations. This can be triggered by causing fact-change events that prompt the Stigmem server to issue HTTP POST requests to these internal endpoints, potentially exposing internal services to unauthorized access or interaction.

The vulnerability allows authenticated users to induce the Stigmem server to send HTTP POST requests to internal services on localhost or private networks. This blind SSRF can be leveraged to interact with internal endpoints that are otherwise inaccessible externally, potentially leading to information disclosure or further internal network compromise depending on the internal services exposed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and monitor for suspicious webhook subscription activity. Avoid exposing sensitive internal services that could be targeted via SSRF.