Missing Authorization Affecting stigmem-node package, versions [,0.9.0a2)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Missing Authorization vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-STIGMEMNODE-17661122
- published28 Jun 2026
- disclosed29 May 2026
- creditUnknown
Introduced: 29 May 2026
CVE NOT AVAILABLE CWE-285 (opens in a new tab)How to fix?
Upgrade stigmem-node to version 0.9.0a2 or higher.
Overview
stigmem-node is a Stigmem reference node — single-host production implementation
Affected versions of this package are vulnerable to Missing Authorization in deployments where authentication is disabled and the node is bound to a non-loopback URL. An attacker can gain unauthorized read, write, and federation access by connecting to the exposed service. This is only exploitable if authentication is intentionally disabled and the service is accessible from outside the local loopback interface.
Workaround
This vulnerability can be mitigated by ensuring authentication remains enabled for all non-local deployments and by not exposing nodes with authentication disabled to untrusted networks.