VULNERABILITY INTELLIGENCE

CVE-2026-76244

CVSS score9.1 CRITICAL

EPSS probability0.27%

CISA KEVNot currently listed

Published2026-08-19

Last modified2026-09-11

Description

stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation traffic to cleartext interception and man-in-the-middle attacks.