CERT

CISA Malcolm

18h ago October 15, 2026 CISA CISA 0 views
View CSAF Summary The following versions of CISA Malcolm are affected: Malcolm <=v26.07.1 (CVE-2026-107336, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334) Malcolm <=v26.08.0 (CVE-2026-107333, CVE-2026-107362) CVSS Vendor Equipment v3 8.1 CISA Malcolm 6 Vulnerabilities Authentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF), Authentication Bypass Using an Alternate Path or Channel, Cross-Site Request Forgery (CSRF), Improper Handling of

View CSAF

Summary

The following versions of CISA Malcolm are affected:

  • Malcolm <=v26.07.1 (CVE-2026-107336, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334)
  • Malcolm <=v26.08.0 (CVE-2026-107333, CVE-2026-107362)
CVSS Vendor Equipment
v3 8.1 CISA Malcolm
6 Vulnerabilities
Authentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF), Authentication Bypass Using an Alternate Path or Channel, Cross-Site Request Forgery (CSRF), Improper Handling of Highly Compressed Data (Data Amplification)

Background

  • Critical Infrastructure Sectors: Energy, Information Technology, Water and Wastewater Systems
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +
CVE-2026-107336
Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (the matcher fires) but evades the rewrite (no redirect is issued), so nginx falls through to the location's proxy_pass to the Arkime backend. That location is the one proxied location in the shipped config that does not include the per-location authentication file, so the request reaches Arkime unauthenticated. The same location also forwards a client-supplied X-Forwarded-User header un-overwritten, and Arkime is configured to trust X-Forwarded-User as the authenticated username — so an unauthenticated network caller can reach the Arkime backend while supplying a forged, auto-provisioned identity.
Read More

1 Affected Product

CISA Malcolm <=v26.07.1

Product Status: known_affected

Remediations

Vendor fix
This vulnerability was patched in Malcolm Version v26.08.0

Additional Metrics

Relevant CWE: CWE-290 Authentication Bypass by Spoofing

CVSS Version Base Score Base Severity Vector String
3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0     CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

View CVE Details

CVE-2026-107333
Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach administrative or role gated endpoints they should not have access to. This affects all restricted paths protected by the RBAC authorization layer, including file upload, PHP server, htadmin, and authentication management interfaces.
Read More

2 Affected Products

CISA Malcolm <=v26.07.1

Product Status: known_affected

Remediations
CISA Malcolm <=v26.08.0

Product Status: known_affected

Remediations

Vendor fix
This vulnerability was patched in Malcolm Version v26.09.0

Additional Metrics

Relevant CWE: CWE-863 Incorrect Authorization

CVSS Version Base Score Base Severity Vector String
3.1 8.1 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0     CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

View CVE Details

CVE-2026-107362
Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an arbitrary URL with curl (including FOLLOWLOCATION) and, for HEAD requests, stores the fetched response body in the upload container's transfer directory and returns the transfer ID to the caller, enabling full readback of the fetched content.
Read More

3 Affected Products

CISA Malcolm <=v26.07.1

Product Status: known_affected

Remediations
CISA Malcolm <=v26.08.0

Product Status: known_affected

Remediations

Vendor fix
This vulnerability was patched in Malcolm Version v26.09.0

CISA Malcolm <=v26.08.0

Product Status: known_affected

Remediations

Vendor fix
This vulnerability was patched in Malcolm Version v26.09.0

Additional Metrics

Relevant CWE: CWE-918 Server-Side Request Forgery (SSRF)

CVSS Version Base Score Base Severity Vector String
3.1 7.1 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
4.0     CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

View CVE Details

CVE-2026-107361
The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-creates users with full access. The passwordSecret is hardcoded to the public value "Malcolm". A network-adjacent attacker bypasses nginx entirely by connecting directly to port 8005 with a forged identity header.
Read More

4 Affected Products

CISA Malcolm <=v26.07.1

Product Status: known_affected

Remediations

Vendor fix
This vulnerability was patched in Malcolm Version v26.08.0

CISA Malcolm <=v26.08.0

Product Status: known_affected

Remediations
CISA Malcolm <=v26.08.0

Product Status: known_affected

Remediations
CISA Malcolm <=v26.07.1

Product Status: known_affected

Remediations

Vendor fix
This vulnerability was patched in Malcolm Version v26.08.0

Additional Metrics

Relevant CWE: CWE-288 Authentication Bypass Using an Alternate Path or Channel

CVSS Version Base Score Base Severity Vector String
3.1 4.2 MEDIUM CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0     CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

View CVE Details

CVE-2026-107337
The Malcolm kiosk Flask application exposes a POST /script_call/ endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring.
Read More

5 Affected Products

CISA Malcolm <=v26.07.1

Product Status: known_affected

Remediations

Vendor fix
This vulnerability was patched in Malcolm Version v26.08.0

CISA Malcolm <=v26.08.0

Product Status: known_affected

Remediations
CISA Malcolm <=v26.08.0

Product Status: known_affected

Remediations
CISA Malcolm <=v26.07.1

Product Status: known_affected

Remediations

Vendor fix
This vulnerability was patched in Malcolm Version v26.08.0

CISA Malcolm <=v26.07.1

Product Status: known_affected

Remediations

Vendor fix
This vulnerability was patched in Malcolm Version v26.08.0

Additional Metrics

Relevant CWE: CWE-352 Cross-Site Request Forgery (CSRF)

CVSS Version Base Score Base Severity Vector String
3.1 7.1 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
4.0     CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:R/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

View CVE Details

CVE-2026-107335
Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file is a single-stream compressed format (.gz, .bz2, .xz, .lzma, .lz) that isn't a .tar.*-style archive. Any authenticated user permitted to upload PCAP/log files can upload a small, highly compressible file (e.g. a gzip bomb) that decompresses to an effectively unbounded size on disk, exhausting the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, and disrupting the platform for all users.
Read More

6 Affected Products

CISA Malcolm <=v26.07.1

Product Status: known_affected

Remediations

Vendor fix
This vulnerability was patched in Malcolm Version v26.08.0

CISA Malcolm <=v26.08.0

Product Status: known_affected

Remediations
CISA Malcolm <=v26.08.0

Product Status: known_affected

Remediations
CISA Malcolm <=v26.07.1

Product Status: known_affected

Remediations

Vendor fix
This vulnerability was patched in Malcolm Version v26.08.0

CISA Malcolm <=v26.07.1

Product Status: known_affected

Remediations

Vendor fix
This vulnerability was patched in Malcolm Version v26.08.0

CISA Malcolm <=v26.07.1

Product Status: known_affected

Remediations

Vendor fix
This vulnerability was patched in Malcolm Version v26.08.0

Additional Metrics

Relevant CWE: CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

CVSS Version Base Score Base Severity Vector String
3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0     CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

View CVE Details

CVE-2026-107334
Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects which location block actually serves the request using the percent-decoded, normalized URI. Because the RBAC check never percent-decodes its input, an authenticated low-privilege user can request an admin-only path using percent-encoding (e.g. /%68tadmin.php) and have nginx route it to the restricted location while the Lua RBAC gate evaluating the un-decoded raw string finds no matching restriction and grants access.
Read More

7 Affected Products

CISA Malcolm <=v26.07.1

Product Status: known_affected

Remediations

Vendor fix
This vulnerability was patched in Malcolm Version v26.08.0

CISA Malcolm <=v26.08.0

Product Status: known_affected

Remediations
CISA Malcolm <=v26.08.0

Product Status: known_affected

Remediations
CISA Malcolm <=v26.07.1

Product Status: known_affected

Remediations

Vendor fix
This vulnerability was patched in Malcolm Version v26.08.0

CISA Malcolm <=v26.07.1

Product Status: known_affected

Remediations

Vendor fix
This vulnerability was patched in Malcolm Version v26.08.0

CISA Malcolm <=v26.07.1

Product Status: known_affected

Remediations

Vendor fix
This vulnerability was patched in Malcolm Version v26.08.0

CISA Malcolm <=v26.07.1

Product Status: known_affected

Remediations

Vendor fix
This vulnerability was patched in Malcolm Version v26.08.0

Additional Metrics

Relevant CWE: CWE-863 Incorrect Authorization

CVSS Version Base Score Base Severity Vector String
3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
4.0     CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

View CVE Details

Acknowledgments

  • Seth Grover of Idaho National Laboratory reported these vulnerabilities to CISA.

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

  • Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-10-07
Date Revision Summary
2026-10-07 1 Initial Publication
2026-10-15 2 Update A - Including self-reference to Web version

Legal Notice and Terms of Use

Read Full Article
Related Articles