PT-2026-47588 · Pypi · Stigmem-Node

Publicado 2026-05-29 · Atualizado 2026-05-29

OSV

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Impact

A mismatch in federation peer-token timestamp handling could cause valid peer tokens to be treated as expired. Impacted deployments are Stigmem nodes using federation peer authentication paths from affected versions. The primary impact is availability and reliability of authenticated federation flows.

Patches

Patched in 0.9.0a2. Federation peer-token timestamp handling now uses the canonical millisecond-based validation path and is covered by regression tests.

Workarounds

Before upgrading, avoid mixed peer-token minting paths and restrict federation use to tightly controlled peers.

Upgrade

Upgrade to the patched release:

pip install --upgrade --pre stigmem-node

If developers install through the Stigmem meta-package instead, they should use the matching extra for deployments, for example:

pip install --upgrade --pre 'stigmem[node]'

Resources

• Release: https://github.com/eidetic-labs/stigmem/releases/tag/v0.9.0a2
• Changelog: https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/CHANGELOG.md#L14-L35
• Security policy and posture: https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/SECURITY.md

Correção

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

GHSA-XH5J-XJFQ-QVVX

Produtos afetados

Stigmem-Node

Referências · 6

• https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/CHANGELOG.md#L14-L35 · Nota
• https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-xh5j-xjfq-qvvx · Nota
• https://github.com/eidetic-labs/stigmem/releases/tag/v0.9.0a2 · Nota
• https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/SECURITY.md · Nota
• https://github.com/eidetic-labs/stigmem · Nota
• https://osv.dev/vulnerability/GHSA-xh5j-xjfq-qvvx · Aviso do Fabricante