Skip to content
OpenAdvisories
High ICSA-26-280-01 7 CVEs

CISA Malcolm

Published Oct 7, 2026 · Updated Oct 15, 2026 · Revision 2

Vendor: CISA Product: Malcolm

Vulnerabilities 7

  • High 8.1
    CVE-2026-107333

    Incorrect Authorization in Malcolm

    Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request…

    CISA Malcolm
  • High 7.1
    CVE-2026-107337

    Cross-Site Request Forgery in Malcolm

    The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wi…

    CISA Malcolm
  • High 7.1
    CVE-2026-107362

    Server-Side Request Forgery in Malcolm

    The bundled FilePond PHP server in Malcolm's file-upload component exposes a fetch route that retrieves an arbitrary URL and returns the response to the caller. An authenticated user can exploit this server-side request forgery (SSRF) to read HTTP, HTTPS, or …

    CISA Malcolm
  • Medium 6.5
    CVE-2026-107335

    Improper Handling of Highly Compressed Data in Malcolm

    Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file …

    CISA Malcolm
  • Medium 6.5
    CVE-2026-107336

    Authentication Bypass by Spoofing in Malcolm

    Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (t…

    CISA Malcolm
  • Medium 5.4
    CVE-2026-107334

    Incorrect Authorization in Malcolm

    Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded …

    CISA Malcolm
  • Medium 4.2
    CVE-2026-107361

    Authentication Bypass Using an Alternate Path or Channel in Malcolm

    The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-creates u…

    CISA Malcolm

Revision history

  1. #2

    Update A - Including self-reference to Web version

  2. #1

    Initial Publication

References