CVE-2026-76242: Improper Certificate Validation in eidetic-labs stigmem
Description
stigmem-node versions before 0.9.0a2 and version 0.9.0 have an improper certificate validation vulnerability. The software accepts federation peer key material during peer registration without requiring an out-of-band administrator fingerprint approval. This allows an attacker who can intercept or misdirect initial registration over the network to register a malicious peer and potentially access or tamper with federation traffic. The issue is fixed in version 0.9.0a2 by introducing a pending approval flow requiring administrator fingerprint verification.
CVSS v4.0
Score 9.1critical
Affected software
eidetic-labs
stigmem
pkg:github/eidetic-labs/stigmemRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
stigmem-node 0.9.0a1 and 0.9.0 accept federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. This improper certificate validation can be exploited by an attacker who intercepts or misdirects initial peer registration over the network to register a malicious peer. Such an attacker could gain unauthorized access to or tamper with federation traffic. The vulnerability is fixed in version 0.9.0a2 by adding a pending approval flow that requires administrator fingerprint verification before accepting peer tokens.
Potential Impact
An attacker capable of intercepting or misdirecting initial federation peer registration can register a malicious peer without administrator approval. This can lead to unauthorized access to federation traffic or tampering with it, potentially compromising confidentiality and integrity of communications within the federation.
Mitigation Recommendations
Upgrade to stigmem-node version 0.9.0a2 or later, which introduces a pending approval flow requiring administrator fingerprint verification before accepting peer tokens. This official fix prevents unauthorized peer registration and mitigates the vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-19T11:38:33.225Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a85bc80acd9273b492f4a36
Added to database: 08/19/2026, 14:24:00 UTC
Last enriched: 09/11/2026, 08:32:37 UTC
Last updated: 10/04/2026, 10:02:29 UTC
Views: 72
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.