CISA Advises on Multiple Critical Vulnerabilities in CISA Malcolm
CISA has issued an advisory detailing several critical vulnerabilities in CISA Malcolm versions prior to v26.08.0, impacting critical infrastructure sectors.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released an advisory highlighting multiple critical vulnerabilities affecting CISA Malcolm software, specifically versions prior to v26.08.0. These vulnerabilities pose significant risks to organizations operating within critical infrastructure sectors, including Energy, Information Technology, and Water and Wastewater Systems.
The advisory details several distinct flaws, including CVE-2026-107336, an authentication bypass vulnerability stemming from an inconsistency in how Malcolm's front nginx reverse proxy handles requests to the Arkime backend. This flaw allows unauthenticated network callers to bypass authentication by spoofing the X-Forwarded-User header, granting them access to the Arkime backend with a forged identity. The vulnerability is rated as HIGH with a CVSS v3.1 score of 6.5.
Another significant vulnerability, CVE-2026-107333, is an incorrect authorization flaw. This issue arises from a URL path normalization inconsistency between Malcolm's role-based access control (RBAC) layer and nginx's request routing. Attackers can exploit this by crafting specially formatted requests to bypass role-based restrictions, gaining unauthorized access to administrative interfaces and sensitive endpoints, including file upload and authentication management. This vulnerability is rated HIGH with a CVSS v3.1 score of 8.1.
Server-side request forgery (SSRF) is addressed by CVE-2026-107362. This vulnerability exists in the file-upload component, which utilizes an unmodified version of the upstream FilePond PHP server. An authenticated user can exploit this by instructing the server to download arbitrary URLs, potentially leading to the exfiltration of sensitive data. This flaw carries a CVSS v3.1 score of 7.1 and is rated HIGH.
Furthermore, CVE-2026-107361 involves an authentication bypass using an alternate path or channel. The Arkime live capture service (arkime-live) is exposed on all network interfaces with default trust for the X-Forwarded-User header and a hardcoded passwordSecret. A network-adjacent attacker can directly connect to this service, bypassing nginx entirely and gaining unauthorized access by providing a forged identity. This vulnerability has a CVSS v3.1 score of 4.2.
Additional vulnerabilities mentioned include CVE-2026-107337, a Cross-Site Request Forgery (CSRF) flaw in the kiosk Flask application's script_call endpoint, and CVE-2026-107335 and CVE-2026-107334, which are also detailed within the advisory. These collectively highlight a broad range of security weaknesses within the affected Malcolm versions.
CISA strongly advises users to update to Malcolm Version v26.08.0, where these vulnerabilities have been patched. The advisory emphasizes the importance of timely patching to protect critical infrastructure from potential exploitation. Organizations are urged to review the full advisory and implement the recommended vendor fixes immediately to mitigate these risks.