CISA Malcolm
CISA patched high-severity Malcolm flaws through version 26.08.0, including authentication bypass and SSRF.
66
Vulnerability1 · 1 read
CVE-2026-107336
Auth bypass and identity spoofing in CISA Malcolm Arkime proxy
- CVSS 3.1
- 6.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Malcolm’s shipped front nginx reverse proxy uses a case-insensitive regex for a Dashboards-to-Arkime shortcut but a case-sensitive rewrite. A path that is not exact lowercase still matches the location, skips the rewrite, and is proxied to Arkime; that location is the only proxied location that does not include the per-location authentication file. The same location forwards a client-supplied X-Forwarded-User header, which Arkime trusts as the username, so an unauthenticated network caller can reach Arkime under a forged, auto-provisioned identity. Impact is limited confidentiality and integrity (CVSS 6.5), not availability, for deployments using this shipped configuration. No public proof-of-concept is known and the issue is not in CISA’s KEV catalog.
What to do: Do not expose the Malcolm web interface to untrusted networks. Until a vendor fix is available, require authentication on every proxied location, including the Dashboards-to-Arkime shortcut, and overwrite or drop client-supplied X-Forwarded-User so Arkime cannot treat it as an identity. Review proxy and Arkime logs for unexpected auto-provisioned users.
| Product | Affected |
|---|---|
| CISA Malcolm | — |
Estimated exposure
nicheLikely hundreds to low thousands of deployments — Malcolm is a specialized CISA network-traffic analysis suite typically deployed on internal defender and ICS analysis networks, not a mass-market product, and no install census or internet-scan count was provided, so this is a rough…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (the matcher fires) but evades the rewrite (no redirect is issued), so nginx falls through to the location's proxy_pass to the Arkime backend. That location is the one proxied location in the shipped config that does not include the per-location authentication file, so the request reaches Arkime unauthenticated. The same location also forwards a client-supplied X-Forwarded-User header un-overwritten, and Arkime is configured to trust X-Forwarded-User as the authenticated username — so an unauthenticated network caller can reach the Arkime backend while supplying a forged, auto-provisioned identity.
- Weakness
- CWE-290, CWE-441, CWE-863
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N