CISA Malcolm
CISA patched high-severity Malcolm flaws through version 26.08.0, including authentication bypass and SSRF.
66
Vulnerability1 · 1 read
CVE-2026-107361
Auth bypass via forged header in Malcolm Arkime live
- CVSS 3.1
- 4.2 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Malcolm’s Arkime live capture service (arkime-live) is configured with host networking so port 8005 listens on all interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any address (userAuthIps=::,0.0.0.0/0), auto-creates accounts with full access, and uses the public hardcoded passwordSecret “Malcolm.” A network-adjacent attacker can skip nginx and connect straight to port 8005 with a forged identity header, gaining limited confidentiality and integrity impact (CVSS 3.1 base 4.2, CWE-288). Operators of Malcolm deployments that run arkime-live this way are affected; no affected version range is stated in the data. There is no known public proof of concept and the CVE is not on the CISA KEV list.
What to do: Do not expose arkime-live port 8005 on all interfaces; allow only the trusted reverse proxy to reach it. Restrict Arkime userAuthIps so X-Forwarded-User is accepted only from that proxy, replace the default passwordSecret, and apply the vendor fix when a patched Malcolm release is published. Review Arkime for unexpected auto-created users with full access.
| Product | Affected |
|---|---|
| CISA / Idaho National Laboratory Malcolm (Arkime live capture service, arkime-live) | — |
Estimated exposure
nicheunknown (likely niche: hundreds to low thousands of deployments) — Malcolm is a specialized open-source network traffic analysis platform used mainly in ICS and enterprise monitoring, not a mass-market product, and the advisory data gives no install or internet-exposure counts.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-creates users with full access. The passwordSecret is hardcoded to the public value "Malcolm". A network-adjacent attacker bypasses nginx entirely by connecting directly to port 8005 with a forged identity header.
- Weakness
- CWE-288
- Vector
- CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N