Executive brief
Stigmem, a distributed data platform, contains a vulnerability where nodes deployed with authentication disabled can be accessed by anyone on the network. If a node is exposed beyond a local development environment without security enabled, unauthorized users can read, write, or modify data and federation settings. This could lead to complete data exposure or unauthorized manipulation of the node's operations.
Technical details
A missing authorization vulnerability (CWE-862/CWE-285) exists in stigmem-node when authentication is explicitly disabled by the operator. While intended for local development, the application failed to restrict these unauthenticated sessions to the loopback interface (127.0.0.1). If an operator binds an unauthenticated node to a public or non-loopback IP address, a remote attacker can gain full administrative-level access (read, write, and federation capabilities) without providing credentials. The fix in version 0.9.0a2 enforces a check that prevents unauthenticated operation when the node is bound to any interface other than loopback.
Affected products
- eidetic-labs stigmem-node < 0.9.0a2
Timeline
- 2026-05-18: patched: Version 0.9.0a2 released
- 2026-05-19: disclosed: Initial advisory publication
- 2026-05-29: advisory: GitHub Advisory reviewed and updated
References
- https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-fp6w-8wpg-74g5
- https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/CHANGELOG.md
- https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/SECURITY.md
- https://github.com/eidetic-labs/stigmem/releases/tag/v0.9.0a2
- https://api.github.com/repos/eidetic-labs/stigmem/security-advisories/GHSA-fp6w-8wpg-74g5