CVE-2026-76244
CriticalCVSS 9.1Summary
stigmem-node contains an insecure default configuration that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation traffic to cleartext interception and man-in-the-middle attacks.
Risk Assessment
Risk of interception and modification of federation traffic by unauthorized parties, potentially leading to confidentiality and integrity breaches.
Recommendation
Enable mTLS for all federation traffic or avoid binding federation to non-loopback addresses when mTLS is disabled.
Original NVD description (English source)
stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation traffic to cleartext interception and man-in-the-middle attacks.