Read the docs
TI-2026-69640 Aliases CVE-2026-107337GHSA-hfc4-x7vw-3m49

Cross-Site Request Forgery in Malcolm

Priority MEDIUM 64CWE-352Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with no authentication and wildcard CORS (CORS(app)). An attacker can use CSRF (CWE-352) to make the operator's browser run arbitrary management commands, including control.py --wipe, which permanently deletes all captured network traffic and forensic logs, and control.py --stop, which stops security monitoring. Versions through 26.07.1 are affected; the CVSS 3.1 base score is 7.1 (HIGH).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00127 2nd percentileScored 2026-11-07
Fix Fixed Malcolm (CISA): 26.08.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CISAMalcolmup to 26.07.126.08.0Patch availableCNA
  • Malcolm VendorCISA Affected up to 26.07.1 Fixed in 26.08.0 Patch available CNA

Remediation

Upgrade Malcolm to 26.08.0, the fixed version. Earlier versions, through 26.07.1, are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Malcolm (CISA) Fixed in 26.08.0

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-107337
  2. 2026-10-09 Alias added: GHSA-hfc4-x7vw-3m49
  3. 2026-10-09 CISA SSVC decision points changed

References

Other 2

  • TI-2026-69642 Server-side request forgery in Malcolm file upload component CVSS 3.1HIGH 7.1
  • TI-2026-69638 Compressed file uploads in Malcolm can exhaust shared disk space CVSS 3.1MEDIUM 6.5
  • TI-2026-69637 Incorrect authorization in Malcolm exposes role-restricted paths CVSS 3.1MEDIUM 5.4
  • TI-2025-24590 CISA Thorium download stream divide by zero CVSS 4.0MEDIUM 5.3
  • TI-2025-24585 CISA Thorium insecure downloaded file path validation CVSS 4.0MEDIUM 5.3
  • TI-2025-41377 Software Acquisition Guide Supplier Response Web Tool XSS CVSS 4.0MEDIUM 4.6
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences