PT-2026-47588 · Pypi · Stigmem-Node

Published 2026-05-29 · Updated 2026-05-29

OSV

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Impact

A mismatch in federation peer-token timestamp handling could cause valid peer tokens to be treated as expired. Impacted deployments are Stigmem nodes using federation peer authentication paths from affected versions. The primary impact is availability and reliability of authenticated federation flows.

Patches

Patched in 0.9.0a2. Federation peer-token timestamp handling now uses the canonical millisecond-based validation path and is covered by regression tests.

Workarounds

Before upgrading, avoid mixed peer-token minting paths and restrict federation use to tightly controlled peers.

Upgrade

Upgrade to the patched release:

pip install --upgrade --pre stigmem-node

If developers install through the Stigmem meta-package instead, they should use the matching extra for deployments, for example:

pip install --upgrade --pre 'stigmem[node]'

Resources

• Release: https://github.com/eidetic-labs/stigmem/releases/tag/v0.9.0a2
• Changelog: https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/CHANGELOG.md#L14-L35
• Security policy and posture: https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/SECURITY.md

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

GHSA-XH5J-XJFQ-QVVX

Affected Products

Stigmem-Node

References · 6

• https://osv.dev/vulnerability/GHSA-xh5j-xjfq-qvvx · Vendor Advisory
• https://github.com/eidetic-labs/stigmem/releases/tag/v0.9.0a2 · Note
• https://github.com/eidetic-labs/stigmem · Note
• https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/SECURITY.md · Note
• https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/CHANGELOG.md#L14-L35 · Note
• https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-xh5j-xjfq-qvvx · Note