CISA Malcolm

CCISA Advisories · 7 hours ago

View CSAF Summary The following versions of CISA Malcolm are affected: Malcolm <=v26.07.1 (CVE-2026-107336, CVE-2026-107333, CVE-2026-107362, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334) Malcolm <=v26.08.0 () CVSS Vendor Equipment v3 8.1 CISA Malcolm 5 Vulnerabilities Authentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF), Authentication Bypass Using an Alternate Path or Channel, Cross-Site Request Forgery (CSRF) Background Critical Infrastructure Sectors: Energy, Information Technology, Water and Wastewater Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-107336 Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (the matcher fires) but evades the rewrite (no redirect is issued), so nginx falls through to the location's proxy_pass to the Arkime backend. That location is the one proxied location in the shipped config that does not include the per-location authentication file, so the request reaches Arkime unauthenticated. The same location also forwards a client-supplied X-Forwarded-User header un-overwritten, and Arkime is configured to trust X-Forwarded-User as the authenticated username — so an unauthenticated network caller can reach the Arkime backend while supplying a forged, auto-provisioned identity. Read More 1 Affected Product CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 Additional Metrics Relevant CWE: CWE-290 Authentication Bypass by Spoofing CVSS Version Base Score Base Severity Vector String 3.1 6.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N 4.0     CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N View CVE Details CVE-2026-107333 Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach administrative or role gated endpoints they should not have access to. This affects all restricted paths protected by the RBAC authorization layer, including file upload, PHP server, htadmin, and authentication management interfaces. Read More 2 Affected Products CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 Additional Metrics Relevant CWE: CWE-863 Incorrect Authorization CVSS Version Base Score Base Severity Vector String 3.1 8.1 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N 4.0     CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N View CVE Details CVE-2026-107362 Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an arbitrary URL with curl (including FOLLOWLOCATION) and, for HEAD requests, stores the fetched response body in the upload container's transfer directory and returns the transfer ID to the caller, enabling full readback of the fetched content. Read More 3 Affected Products CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 Additional Metrics Relevant CWE: CWE-918 Server-Side Request Forgery (SSRF) CVSS Version Base Score Base Severity Vector String 3.1 7.1 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L 4.0     CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N View CVE Details CVE-2026-107361 The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-creates users with full access. The passwordSecret is hardcoded to the public value "Malcolm". A network-adjacent attacker bypasses nginx entirely by connecting directly to port 8005 with a forged identity header. Read More 4 Affected Products CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 Additional Metrics Relevant CWE: CWE-288 Authentication Bypass Using an Alternate Path or Channel CVSS Version Base Score Base Severity Vector String 3.1 4.2 HIGH CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N 4.0     CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N View CVE Details CVE-2026-107337 The Malcolm kiosk Flask application exposes a POST /script_call/ endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring. Read More 5 Affected Products CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 Additional Metrics Relevant CWE: CWE-352 Cross-Site Request Forgery (CSRF) CVSS Version Base Score Base Severity Vector String 3.1 7.1 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H 4.0     CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:R/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N View CVE Details CVE-2026-107335 Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file is a single-stream compressed format (.gz, .bz2, .xz, .lzma, .lz) that isn't a .tar.*-style archive. Any authenticated user permitted to upload PCAP/log files can upload a small, highly compressible file (e.g. a gzip bomb) that decompresses to an effectively unbounded size on disk, exhausting the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, and disrupting the platform for all users. Read More 6 Affected Products CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 Additional Metrics Relevant CWE: CWE-409 Cross-Site Request Forgery (CSRF) CVSS Version Base Score Base Severity Vector String 3.1 6.5 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H 4.0     CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N View CVE Details CVE-2026-107334 Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects which location block actually serves the request using the percent-decoded, normalized URI. Because the RBAC check never percent-decodes its input, an authenticated low-privilege user can request an admin-only path using percent-encoding (e.g. /%68tadmin.php) and have nginx route it to the restricted location while the Lua RBAC gate evaluating the un-decoded raw string finds no matching restriction and grants access. Read More 7 Affected Products CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 CISA Malcolm <=v26.07.1 Product Status: known_affected Remediations Vendor fixThis vulnerability was patched in Malcolm Version v26.08.0 Additional Metrics Relevant CWE: CWE-863 Cross-Site Request Forgery (CSRF) CVSS Version Base Score Base Severity Vector String 3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N 4.0     CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N View CVE Details Acknowledgments Seth Grover of Idaho National Laboratory reported these vulnerabilities to CISA. Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Revision History Initial Release Date: 2026-10-07 Date Revision Summary 2026-10-07 1 Initial Publication 2026-10-15 2 Update A - Including self-reference to Web version Legal Notice and Terms of Use