Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-76245 (GCVE-0-2026-76245)

Vulnerability from cvelistv5 – Published: 2026-08-19 14:02 – Updated: 2026-08-20 15:22

Title

stigmem Federation Peer Token Timestamp Validation Bypass

Summary

stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated federation flows on nodes using federation peer authentication paths. The issue is fixed in 0.9.0a2, which uses the canonical millisecond-based validation path.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-20 13:41 UTC

CWE

CWE-345 - Insufficient Verification of Data Authenticity

Assigner

VulnCheck CNA

References

2 references

URL	Tags
https://github.com/eidetic-labs/stigmem/security/…	vendor-advisory
https://www.vulncheck.com/advisories/stigmem-fede…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
eidetic-labs	stigmem	Affected: 0 , < 0.9.0a2 (custom) Unaffected: 0.9.0a2 (custom)

Date Public

2026-05-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76245",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T13:41:37.893636Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T15:22:37.989Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/stigmem-node",
          "product": "stigmem",
          "vendor": "eidetic-labs",
          "versions": [
            {
              "lessThan": "0.9.0a2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "0.9.0a2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-05-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated federation flows on nodes using federation peer authentication paths. The issue is fixed in 0.9.0a2, which uses the canonical millisecond-based validation path."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T14:02:21.529Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-xh5j-xjfq-qvvx)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-xh5j-xjfq-qvvx"
        },
        {
          "name": "VulnCheck Advisory: stigmem Federation Peer Token Timestamp Validation Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/stigmem-federation-peer-token-timestamp-validation-bypass"
        }
      ],
      "title": "stigmem Federation Peer Token Timestamp Validation Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-76245",
    "datePublished": "2026-08-19T14:02:21.529Z",
    "dateReserved": "2026-08-19T11:38:33.225Z",
    "dateUpdated": "2026-08-20T15:22:37.989Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76244 (GCVE-0-2026-76244)

Vulnerability from cvelistv5 – Published: 2026-08-19 14:02 – Updated: 2026-08-19 14:30

Title

stigmem-node Insecure Federation Transport Configuration

Summary

stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation traffic to cleartext interception and man-in-the-middle attacks.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-19 14:21 UTC

CWE

CWE-319 - Cleartext Transmission of Sensitive Information

Assigner

VulnCheck CNA

References

2 references

URL	Tags
https://github.com/eidetic-labs/stigmem/security/…	vendor-advisory
https://www.vulncheck.com/advisories/stigmem-node…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
eidetic-labs	stigmem	Affected: 0 , < 0.9.0a2 (custom) Unaffected: 0.9.0a2 (custom)

Date Public

2026-05-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76244",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T14:21:53.457437Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T14:30:02.087Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/stigmem-node",
          "product": "stigmem",
          "vendor": "eidetic-labs",
          "versions": [
            {
              "lessThan": "0.9.0a2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "0.9.0a2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-05-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation traffic to cleartext interception and man-in-the-middle attacks."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "Cleartext Transmission of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T14:02:20.847Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-jmfc-hfjq-pxcp)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-jmfc-hfjq-pxcp"
        },
        {
          "name": "VulnCheck Advisory: stigmem-node Insecure Federation Transport Configuration",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/stigmem-node-insecure-federation-transport-configuration"
        }
      ],
      "title": "stigmem-node Insecure Federation Transport Configuration",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-76244",
    "datePublished": "2026-08-19T14:02:20.847Z",
    "dateReserved": "2026-08-19T11:38:33.225Z",
    "dateUpdated": "2026-08-19T14:30:02.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76243 (GCVE-0-2026-76243)

Vulnerability from cvelistv5 – Published: 2026-08-19 14:02 – Updated: 2026-08-25 02:01

Title

stigmem before 0.9.0a2 Authentication Bypass via Disabled Auth

Summary

stigmem versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback deployments. Attackers can perform read, write, and federation operations with anonymous identity when nodes are exposed outside local development environments.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 02:01 UTC

CWE

CWE-285 - Improper Authorization

Assigner

VulnCheck CNA

References

2 references

URL	Tags
https://github.com/eidetic-labs/stigmem/security/…	vendor-advisory
https://www.vulncheck.com/advisories/stigmem-befo…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
eidetic-labs	stigmem	Affected: 0 , < 0.9.0a2 (custom) Unaffected: 0.9.0a2 (custom)

Date Public

2026-05-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76243",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T02:01:28.533475Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T02:01:37.954Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/stigmem-node",
          "product": "stigmem",
          "vendor": "eidetic-labs",
          "versions": [
            {
              "lessThan": "0.9.0a2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "0.9.0a2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-05-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "stigmem versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback deployments. Attackers can perform read, write, and federation operations with anonymous identity when nodes are exposed outside local development environments."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T14:02:20.160Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-fp6w-8wpg-74g5)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-fp6w-8wpg-74g5"
        },
        {
          "name": "VulnCheck Advisory: stigmem before 0.9.0a2 Authentication Bypass via Disabled Auth",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/stigmem-before-0a2-authentication-bypass-via-disabled-auth"
        }
      ],
      "title": "stigmem before 0.9.0a2 Authentication Bypass via Disabled Auth",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-76243",
    "datePublished": "2026-08-19T14:02:20.160Z",
    "dateReserved": "2026-08-19T11:38:33.225Z",
    "dateUpdated": "2026-08-25T02:01:37.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76242 (GCVE-0-2026-76242)

Vulnerability from cvelistv5 – Published: 2026-08-19 14:02 – Updated: 2026-08-20 15:38

Title

stigmem Federation Peer Registration Authentication Bypass

Summary

stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker can register a malicious peer and gain access to or tamper with federation traffic. Fixed in 0.9.0a2, which introduces a pending approval flow requiring administrator fingerprint verification before peer tokens are accepted.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-20 15:37 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

VulnCheck CNA

References

2 references

URL	Tags
https://github.com/eidetic-labs/stigmem/security/…	vendor-advisory
https://www.vulncheck.com/advisories/stigmem-fede…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
eidetic-labs	stigmem	Affected: 0 , < 0.9.0a2 (custom) Unaffected: 0.9.0a2 (custom)

Date Public

2026-05-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76242",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T15:37:49.018621Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T15:38:01.701Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/stigmem-node",
          "product": "stigmem",
          "vendor": "eidetic-labs",
          "versions": [
            {
              "lessThan": "0.9.0a2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "0.9.0a2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-05-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker can register a malicious peer and gain access to or tamper with federation traffic. Fixed in 0.9.0a2, which introduces a pending approval flow requiring administrator fingerprint verification before peer tokens are accepted."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T14:02:19.435Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-9vp8-3hmv-8fgh)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-9vp8-3hmv-8fgh"
        },
        {
          "name": "VulnCheck Advisory: stigmem Federation Peer Registration Authentication Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/stigmem-federation-peer-registration-authentication-bypass"
        }
      ],
      "title": "stigmem Federation Peer Registration Authentication Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-76242",
    "datePublished": "2026-08-19T14:02:19.435Z",
    "dateReserved": "2026-08-19T11:38:33.225Z",
    "dateUpdated": "2026-08-20T15:38:01.701Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76241 (GCVE-0-2026-76241)

Vulnerability from cvelistv5 – Published: 2026-08-19 14:02 – Updated: 2026-08-21 19:29

Title

stigmem Plugin Signature Enforcement Bypass via Configuration

Summary

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned (potentially malicious) plugin code could be loaded and executed, resulting in arbitrary code execution. Fixed in 0.9.0a2, which requires a second explicit acknowledgment to disable signature enforcement.

Severity

7.3 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 19:29 UTC

CWE

CWE-494 - Download of Code Without Integrity Check

Assigner

VulnCheck CNA

References

2 references

URL	Tags
https://github.com/eidetic-labs/stigmem/security/…	vendor-advisory
https://www.vulncheck.com/advisories/stigmem-plug…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
eidetic-labs	stigmem	Affected: 0 , < 0.9.0a2 (custom) Unaffected: 0.9.0a2 (custom)

Date Public

2026-05-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76241",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T19:29:11.779224Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T19:29:28.273Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/stigmem-node",
          "product": "stigmem",
          "vendor": "eidetic-labs",
          "versions": [
            {
              "lessThan": "0.9.0a2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "0.9.0a2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-05-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned (potentially malicious) plugin code could be loaded and executed, resulting in arbitrary code execution. Fixed in 0.9.0a2, which requires a second explicit acknowledgment to disable signature enforcement."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-494",
              "description": "Download of Code Without Integrity Check",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T14:02:18.743Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-w7pm-9g55-mxfm)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-w7pm-9g55-mxfm"
        },
        {
          "name": "VulnCheck Advisory: stigmem Plugin Signature Enforcement Bypass via Configuration",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/stigmem-plugin-signature-enforcement-bypass-via-configuration"
        }
      ],
      "title": "stigmem Plugin Signature Enforcement Bypass via Configuration",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-76241",
    "datePublished": "2026-08-19T14:02:18.743Z",
    "dateReserved": "2026-08-19T11:38:33.225Z",
    "dateUpdated": "2026-08-21T19:29:28.273Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76240 (GCVE-0-2026-76240)

Vulnerability from cvelistv5 – Published: 2026-08-19 14:02 – Updated: 2026-08-20 15:22

Title

stigmem Postgres SQL Injection via Schema Identifier

Summary

stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input. Fixed in 0.9.0a2, which adds identifier quoting and validation. As a workaround, only configure schema names from trusted deployment configuration.

Severity

7.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-20 13:47 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

VulnCheck CNA

References

2 references

URL	Tags
https://github.com/eidetic-labs/stigmem/security/…	vendor-advisory
https://www.vulncheck.com/advisories/stigmem-post…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
eidetic-labs	stigmem	Affected: 0 , < 0.9.0a2 (custom) Unaffected: 0.9.0a2 (custom)

Date Public

2026-05-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76240",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T13:47:22.730298Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T15:22:44.363Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/stigmem-node",
          "product": "stigmem",
          "vendor": "eidetic-labs",
          "versions": [
            {
              "lessThan": "0.9.0a2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "0.9.0a2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-05-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input. Fixed in 0.9.0a2, which adds identifier quoting and validation. As a workaround, only configure schema names from trusted deployment configuration."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T14:02:18.061Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-9pc9-4crj-mhpj)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-9pc9-4crj-mhpj"
        },
        {
          "name": "VulnCheck Advisory: stigmem Postgres SQL Injection via Schema Identifier",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/stigmem-postgres-sql-injection-via-schema-identifier"
        }
      ],
      "title": "stigmem Postgres SQL Injection via Schema Identifier",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-76240",
    "datePublished": "2026-08-19T14:02:18.061Z",
    "dateReserved": "2026-08-19T11:38:33.224Z",
    "dateUpdated": "2026-08-20T15:22:44.363Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

6 vulnerabilities found for stigmem by eidetic-labs

CVE-2026-76245 (GCVE-0-2026-76245)

CVE-2026-76244 (GCVE-0-2026-76244)

CVE-2026-76243 (GCVE-0-2026-76243)

CVE-2026-76242 (GCVE-0-2026-76242)

CVE-2026-76241 (GCVE-0-2026-76241)

CVE-2026-76240 (GCVE-0-2026-76240)