Security advisories

medium2026-08-20

stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address

GHSA-5p3m-vhh6-9236

high2026-06-19

stigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)

GHSA-6gqw-jqv7-v88m

high2026-06-19

stistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)

GHSA-xhv3-q4xx-349r

high2026-06-19

stigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)

GHSA-x26h-xmv8-gxf7

critical2026-05-29

stigmem-node's federation peer registration lacked explicit out-of-band approval

GHSA-9vp8-3hmv-8fgh

high2026-05-29

stigmem-node's unsigned plugin override could be enabled without a second explicit acknowledgment

GHSA-w7pm-9g55-mxfm

critical2026-05-29

stigmem-node's federation insecure transport settings may allow non-loopback cleartext federation

GHSA-jmfc-hfjq-pxcp

high2026-05-29

stigmem-node's Postgres schema identifier handling required defensive quoting

GHSA-9pc9-4crj-mhpj

high2026-05-29

stigmem-node's federation peer token timestamp validation may reject valid peer tokens

GHSA-xh5j-xjfq-qvvx

critical2026-05-29

stigmem-node: Auth-disabled deployments may grant broad anonymous access outside loopback

GHSA-fp6w-8wpg-74g5