{"id":"CVE-2026-76243","aliases":["GHSA-fp6w-8wpg-74g5"],"url":"https://o3.security/vulnerability/CVE-2026-76243","summary":"stigmem before 0.9.0a2 Authentication Bypass via Disabled Auth","details":"### Impact\nStigmem nodes configured with authentication disabled could grant the anonymous identity broad read/write/federation capabilities if exposed outside a loopback-only local development environment. Impacted users are operators who intentionally disabled authentication while binding the node to a non-loopback URL.\n\n### Patches\nPatched in 0.9.0a2. The node now refuses unauthenticated operation outside loopback-only local development.\n\n### Workarounds\nBefore upgrading, keep authentication enabled for all non-local deployments and do not expose nodes with authentication disabled to untrusted networks.\n\n### Upgrade\nUpgrade to the patched release:\n\n```bash\npip install --upgrade --pre stigmem-node\n```\n\nIf developers install through the Stigmem meta-package instead, they should use the matching extra for their deployments, for example:\n\n```bash\npip install --upgrade --pre 'stigmem[node]'\n```\n\n### Resources\n- Release: https://github.com/eidetic-labs/stigmem/releases/tag/v0.9.0a2\n- Changelog: https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/CHANGELOG.md#L14-L35\n- Security policy and posture: https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/SECURITY.md","published":"2026-08-19T14:02:20.160Z","modified":"2026-09-26T03:30:54.681218284Z","cvss":null,"epss":{"score":0.004,"percentile":0.33427,"asOf":"2026-08-20"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"stigmem-node","fixedVersion":"0.9.0a2"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76243.json"},{"type":"ADVISORY","url":"https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-fp6w-8wpg-74g5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76243"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/stigmem-before-0a2-authentication-bypass-via-disabled-auth"},{"type":"PACKAGE","url":"https://github.com/eidetic-labs/stigmem"},{"type":"WEB","url":"https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/CHANGELOG.md#L14-L35"},{"type":"WEB","url":"https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/SECURITY.md"},{"type":"WEB","url":"https://github.com/eidetic-labs/stigmem/releases/tag/v0.9.0a2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-26T03:30:54.681218284Z"}}