GHSA-fp6w-8wpg-74g5: stigmem-node: Auth-disabled deployments may grant broad anonymous access outside loopback

Should you act?

• Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with pip-audit (or: pip show <package>).
• No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

Details

Impact Stigmem nodes configured with authentication disabled could grant the anonymous identity broad read/write/federation capabilities if exposed outside a loopback-only local development environment. Impacted users are operators who intentionally disabled authentication while binding the node to a non-loopback URL.

Patches Patched in 0.9.0a2. The node now refuses unauthenticated operation outside loopback-only local development.

Workarounds Before upgrading, keep authentication enabled for all non-local deployments and do not expose nodes with authentication disabled to untrusted networks.

Upgrade Upgrade to the patched release:

If developers install through the Stigmem meta-package instead, they should use the matching extra for their deployments, for example:

Resources - Release: https://github.com/eidetic-labs/stigmem/releases/tag/v0.9.0a2 - Changelog: https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/CHANGELOG.md#L14-L35 - Security policy and posture: https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/SECURITY.md

CVSS: 9.2 (v4.0) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Sources and references

1. GitHub Advisory GHSA-fp6w-8wpg-74g5 github.com
2. github.com github.com
3. github.com github.com
4. github.com github.com
5. github.com github.com

Critical PyPI advisories · Today’s Security Digest