Executive brief
Stigmem-node is a component used for managing federated network nodes. A security flaw in its registration process allowed new nodes to join the network without an administrator's manual approval of their security credentials. This could allow an attacker to intercept or misdirect network traffic by masquerading as a legitimate peer, potentially compromising the confidentiality and integrity of the entire federated system.
Technical details
The federation peer registration process in stigmem-node prior to version 0.9.0a2 accepted peer public key material automatically without requiring an out-of-band fingerprint verification or administrative approval. This vulnerability (CWE-295/CWE-345) allows an attacker who can intercept or misdirect initial registration traffic to register as a trusted peer. Once registered, the attacker can participate in federation traffic, leading to high confidentiality and integrity impacts. The fix introduces a pending approval flow where peer tokens are only accepted after an administrator manually verifies the fingerprint.
Affected products
- eidetic-labs stigmem-node < 0.9.0a2
Timeline
- 2026-05-18: patched: Version 0.9.0a2 released
- 2026-05-19: disclosed: Initial advisory publication
- 2026-05-29: advisory: GitHub Advisory reviewed and updated
References
- https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-9vp8-3hmv-8fgh
- https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/CHANGELOG.md
- https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/SECURITY.md
- https://github.com/eidetic-labs/stigmem/releases/tag/v0.9.0a2
- https://api.github.com/repos/eidetic-labs/stigmem/security-advisories/GHSA-9vp8-3hmv-8fgh