Insufficient Verification of Data Authenticity

Overview stigmem-node is a Stigmem reference node — single-host production implementation Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the peer registration process. An attacker can impersonate a federation peer or intercept registration by...

stigmem-node's federation peer registration lacked explicit out-of-band approval

Impact Federation peer registration accepted peer key material during registration without a separate administrator approval step based on an out-of-band fingerprint check. Impacted deployments are nodes that accept federation peer registration across a network where initial registration could be...

Active Debug Code

Overview stigmem-node is a Stigmem reference node — single-host production implementation Affected versions of this package are vulnerable to Active Debug Code in the federation process when mTLS is explicitly disabled and the node is bound to a non-loopback URL. An attacker can intercept sensiti...

SQL Injection

Overview stigmem-node is a Stigmem reference node — single-host production implementation Affected versions of this package are vulnerable to SQL Injection in the handling of Postgres schema identifiers due to improper quoting and interpolation into SQL strings. An attacker can execute arbitrary...

Insufficient Verification of Data Authenticity

Overview stigmem-node is a Stigmem reference node — single-host production implementation Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity due to improper validation in the peer-token timestamp process. An attacker can cause valid authentication...

GHSA-FP6W-8WPG-74G5 stigmem-node: Auth-disabled deployments may grant broad anonymous access outside loopback

Impact Stigmem nodes configured with authentication disabled could grant the anonymous identity broad read/write/federation capabilities if exposed outside a loopback-only local development environment. Impacted users are operators who intentionally disabled authentication while binding the node ...

Missing Authorization

Overview stigmem-node is a Stigmem reference node — single-host production implementation Affected versions of this package are vulnerable to Missing Authorization in deployments where authentication is disabled and the node is bound to a non-loopback URL. An attacker can gain unauthorized read,...

PT-2026-78422

Name of the Vulnerable Software and Affected Versions stigmem-node version 0.9.0a1 Description Plugin signature enforcement can be disabled using a single configuration flag without requiring a second explicit acknowledgment. In environments where plugin directories are writable by less-trusted...