Read the docs
TI-2026-69639 Aliases CVE-2026-107336GHSA-c366-pv2g-9685

Authentication bypass in Malcolm exposes Arkime backend

Priority LOW 34CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

Malcolm through version 26.07.1 has an authentication bypass in its nginx reverse proxy. A case-insensitive location matcher paired with a case-sensitive rewrite lets requests with unusual letter case in the path skip the per-location authentication file and reach the Arkime backend. The same location forwards a client-supplied X-Forwarded-User header, which Arkime trusts as the username, so an unauthenticated network attacker can reach Arkime under a forged identity (CWE-290).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (the matcher fires) but evades the rewrite (no redirect is issued), so nginx falls through to the location's proxy_pass to the Arkime backend. That location is the one proxied location in the shipped config that does not include the per-location authentication file, so the request reaches Arkime unauthenticated. The same location also forwards a client-supplied X-Forwarded-User header un-overwritten, and Arkime is configured to trust X-Forwarded-User as the authenticated username — so an unauthenticated network caller can reach the Arkime backend while supplying a forged, auto-provisioned identity.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00241 15th percentileScored 2026-11-07
Fix Fixed Malcolm (CISA): 26.08.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CISAMalcolmup to 26.07.126.08.0Patch availableCNA
  • Malcolm VendorCISA Affected up to 26.07.1 Fixed in 26.08.0 Patch available CNA

Remediation

Upgrade Malcolm to version 26.08.0, which is the fixed version listed for this flaw. Versions through 26.07.1 are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Malcolm (CISA) Fixed in 26.08.0

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-107336
  2. 2026-10-09 Alias added: GHSA-c366-pv2g-9685
  3. 2026-10-09 CISA SSVC decision points changed
  4. 2026-10-09 Priority changed: MEDIUM → LOW

References

Other 2

  • TI-2026-69642 Server-side request forgery in Malcolm file upload component CVSS 3.1HIGH 7.1
  • TI-2026-69640 Cross-Site Request Forgery in Malcolm CVSS 3.1HIGH 7.1
  • TI-2026-69638 Compressed file uploads in Malcolm can exhaust shared disk space CVSS 3.1MEDIUM 6.5
  • TI-2026-69637 Incorrect authorization in Malcolm exposes role-restricted paths CVSS 3.1MEDIUM 5.4
  • TI-2025-24590 CISA Thorium download stream divide by zero CVSS 4.0MEDIUM 5.3
  • TI-2025-24585 CISA Thorium insecure downloaded file path validation CVSS 4.0MEDIUM 5.3
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences