Advisories › CISA › ICSA-26-280-01
CISA Malcolm: 7 CVEs, High 8.1
Summary
CISA reports 7 vulnerabilities in CISA Malcolm. Weakness types: Authentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF) (+3 more). Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to gain access to the Arkime backend API under a forged identity, bypassing Malcolm's nginx authentication gate entirely. Highest CVSS v3 score: 8.1 (High), exploitable over the network.
What to do: Prioritize: This vulnerability was patched in Malcolm Version v26.08.0
At a glance
- Vendor
- CISA
- Products
- Malcolm
- CVEs
- CVE-2026-107336, CVE-2026-107333, CVE-2026-107362, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334
- Highest CVSS v3
- 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Energy, Information Technology, Water and Wastewater Systems
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-107336 | Authentication Bypass by Spoofing | 6.5 | – | No | Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (the matcher fires) but evades the rewrite (no redirect is issued), so nginx falls through to the location's proxy_pass to the Arkime backend. … |
| CVE-2026-107333 | Incorrect Authorization | 8.1 | – | No | Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach administrative or role gated endpoints they should not have access to. This affects all res… |
| CVE-2026-107362 | Server-Side Request Forgery (SSRF) | 7.1 | – | No | Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an arbitrary URL with curl (including FOLLOWLOCATION) and, for HEAD requests, stores the fetched respo… |
| CVE-2026-107361 | Authentication Bypass Using an Alternate Path or Channel | 4.2 | – | No | The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-creates users with full access. The passwordSecret is hardcoded to the public value "Malcolm". A network-adjacent attacker bypasses nginx entirely by … |
| CVE-2026-107337 | Cross-Site Request Forgery (CSRF) | 7.1 | – | No | The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring. |
| CVE-2026-107335 | Improper Handling of Highly Compressed Data (Data Amplification) | 6.5 | – | No | Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file is a single-stream compressed format (.gz, .bz2, .xz, .lzma, .lz) that isn't a .tar.*-style archive. Any authenticated user permitted to uplo… |
| CVE-2026-107334 | Incorrect Authorization | 5.4 | – | No | Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects which location block actually serves the request using the percent-decoded, normalized URI. Becau… |
Affected products (2)
- CISA Malcolm <=v26.07.1
- CISA Malcolm <=v26.08.0
Vendor fixes and mitigations (from advisory)
- Vendor Fix: This vulnerability was patched in Malcolm Version v26.08.0
- Vendor Fix: This vulnerability was patched in Malcolm Version v26.09.0
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.