---
id: CVE-2026-76243
aliases:
  - GHSA-fp6w-8wpg-74g5
title: >-
  stigmem-node: Auth-disabled deployments may grant broad anonymous access
  outside loopback
summary: >-
  stigmem-node: Auth-disabled deployments may grant broad anonymous access
  outside loopback
severity: critical
vendor: stigmem-node
product: stigmem-node
ecosystem: pip
affected:
  - stigmem-node < 0.9.0a2
patched:
  - stigmem-node 0.9.0a2
published: '2026-05-29'
updated: '2026-08-20'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-fp6w-8wpg-74g5'
references:
  - url: >-
      https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-fp6w-8wpg-74g5
  - url: 'https://github.com/eidetic-labs/stigmem'
  - url: 'https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/CHANGELOG.md#L14-L35'
  - url: 'https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/SECURITY.md'
  - url: 'https://github.com/eidetic-labs/stigmem/releases/tag/v0.9.0a2'
tags:
  - osv
  - pip
epss: 0.004
epssPercentile: 0.3403
ingestedAt: '2026-08-20T19:23:05.949Z'
---

## Overview

### Impact
Stigmem nodes configured with authentication disabled could grant the anonymous identity broad read/write/federation capabilities if exposed outside a loopback-only local development environment. Impacted users are operators who intentionally disabled authentication while binding the node to a non-loopback URL.

### Patches
Patched in 0.9.0a2. The node now refuses unauthenticated operation outside loopback-only local development.

### Workarounds
Before upgrading, keep authentication enabled for all non-local deployments and do not expose nodes with authentication disabled to untrusted networks.

### Upgrade
Upgrade to the patched release:

```bash
pip install --upgrade --pre stigmem-node
```

If developers install through the Stigmem meta-package instead, they should use the matching extra for their deployments, for example:

```bash
pip install --upgrade --pre 'stigmem[node]'
```

### Resources
- Release: https://github.com/eidetic-labs/stigmem/releases/tag/v0.9.0a2
- Changelog: https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/CHANGELOG.md#L14-L35
- Security policy and posture: https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/SECURITY.md

## Affected packages

- `stigmem-node < 0.9.0a2`

## Remediation

Upgrade to a patched release:

- `stigmem-node 0.9.0a2`