CVE-2026-76244 — stigmem-node Insecure Federation Transport Configuration
stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are…
Published: 2026-08-19 · CVSS: 9.1 · CVSS 4.0
stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation traffic to cleartext interception and man-in-the-middle attacks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7