CVE-2026-107337

The Malcolm kiosk Flask application exposes POST /script_call/ with no authentication and wildcard CORS. An attacker can use a cross-site request to make an operator’s browser invoke management commands, including control.py --wipe, which permanently deletes captured network traffic and forensic logs, or control.py --stop, which stops security monitoring. Impact is high integrity and availability loss with no confidentiality impact; the issue is rated CVSS 7.1 and requires the operator’s browser (user interaction). It affects deployments of the Malcolm kiosk. There is no known public proof of concept and it is not in CISA’s KEV catalog.

What to do: Until a vendor fix is available, do not use the Malcolm kiosk browser to visit untrusted sites, and restrict the kiosk UI to a dedicated management network. Require authentication and CSRF protection on POST /script_call/, and remove wildcard CORS. Check whether monitoring was stopped or captured traffic and forensic logs were wiped, and restore from backups if they were.