Executive brief
Stigmem is a platform for distributed data synchronization. A configuration flaw in its node component allows federation traffic—the data shared between different servers—to be transmitted in unencrypted cleartext over the network. This could allow an attacker to intercept or modify sensitive data as it moves between nodes if mTLS is not properly enforced.
Technical details
The stigmem-node component fails to enforce secure transport (mTLS) for federation traffic when bound to non-loopback interfaces. This vulnerability (CWE-319 and CWE-489) occurs when operators enable federation and explicitly disable mTLS while binding the node to a network-reachable URL. An attacker on the network could intercept or modify cleartext federation traffic, compromising the confidentiality and integrity of the distributed system. The issue is addressed in version 0.9.0a2, which now refuses insecure federation configurations unless they are restricted to loopback interfaces.
Affected products
- eidetic-labs stigmem-node < 0.9.0a2
Timeline
- 2026-05-19: disclosed
- 2026-05-19: patched: Patched in 0.9.0a2
- 2026-05-29: advisory