CVE-2026-76245: Insufficient Verification of Data Authenticity

stigmem pip package stigmem-node version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated federation flows on nodes using...

CVE-2026-76242: Improper Certificate Validation

stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker can...

CVE-2026-76241: Download of Code Without Integrity Check

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned potentially malicious plugin code...

CVE-2026-76240: Improper Neutralization of Special Elements used in an SQL Command

stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input...

CVE-2026-76237: Authorization Bypass Through User-Controlled Key

stigmem-node before 0.9.0a12 contains a broken object level authorization cross-tenant BOLA vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count queries and getquarantinedfact in routes/quarantine.py lacked a...

CVE-2026-76244: Cleartext Transmission of Sensitive Information

stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation...

CVE-2026-76236: Authorization Bypass Through User-Controlled Key

stigmem-node before 0.9.0a12 contains a cross-tenant broken object level authorization BOLA flaw in the RTBF right-to-be-forgotten tombstone mechanism. issuetombstone defaulted the tenant to "default" instead of the caller's tenant, allowing deletion records to be written to the wrong tenant, and...

PT-2026-78417

Name of the Vulnerable Software and Affected Versions stigmem-node versions prior to 0.9.0a12 Description A broken object level authorization BOLA flaw exists in the right-to-be-forgotten RTBF tombstone mechanism. The issue tombstone function defaulted the tenant to "default" instead of the...

PT-2026-78421

Name of the Vulnerable Software and Affected Versions stigmem-node version 0.9.0a1 Description The software interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. While the schema value in the affected code path is operator-controlled, this pattern could allo...

PT-2026-78423

Name of the Vulnerable Software and Affected Versions stigmem-node version 0.9.0a1 Description stigmem-node accepts federation peer key material during peer registration without requiring a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer...

PT-2026-78426

Name of the Vulnerable Software and Affected Versions stigmem pip package stigmem-node version 0.9.0a1 Description A timestamp-handling mismatch exists in federation peer-token validation. This issue can cause valid peer tokens to be incorrectly treated as expired, impacting the availability and...

PT-2026-78425

stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation...

stigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)

Summary On a multi-tenant stigmem node, a caller holding a write credential for one tenant can run a decay sweep that acts on every tenant's facts. The candidate-selection queries in lifecycle/decay.py selectttlcandidates, selectconfidencecandidates carried no tenantid predicate, and the caller's...

Incorrect Authorization

Overview stigmem-node is a Stigmem reference node — single-host production implementation Affected versions of this package are vulnerable to Incorrect Authorization in the rundecaysweep process. An attacker can access or modify data belonging to other tenants by initiating a decay sweep with a...

GHSA-6GQW-JQV7-V88M stigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)

Summary On a multi-tenant stigmem node, a caller holding a write credential for one tenant can run a decay sweep that acts on every tenant's facts. The candidate-selection queries in lifecycle/decay.py selectttlcandidates, selectconfidencecandidates carried no tenantid predicate, and the caller's...

stistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)

Summary On a multi-tenant stigmem node, a tenant administrator could list, read, and admit or reject quarantined facts belonging to other tenants. The list/count queries and getquarantinedfact in routes/quarantine.py lacked an f.tenantid = identity.tenantid predicate, and the garden lookup was no...

Incorrect Authorization

Overview stigmem-node is a Stigmem reference node — single-host production implementation Affected versions of this package are vulnerable to Incorrect Authorization in the routes/quarantine.py process. An attacker can access and modify other tenants' quarantined data by sending requests to the...

Authorization Bypass Through User-Controlled Key

Overview stigmem-node is a Stigmem reference node — single-host production implementation Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the issuetombstone process and the read-suppression path, where tenant scoping is not properly enforced...

GHSA-X26H-XMV8-GXF7 stigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)

Summary On a multi-tenant stigmem node, RTBF right-to-be-forgotten tombstones were mis-scoped two ways. 1 issuetombstone defaulted the tenant to "default" instead of the caller's tenant, so tombstones could be written to the wrong tenant. 2 The read-suppression path — gettombstonefilter...

PT-2026-78418

Name of the Vulnerable Software and Affected Versions stigmem-node versions prior to 0.9.0a12 Description Broken object level authorization BOLA exists in the quarantine review endpoints. In multi-tenant deployments using the stigmem-plugin-multi-tenant plugin, the get quarantined fact function i...