Cisa Malcolm
17 CVEs affecting Cisa Malcolm. Latest disclosed: 2026-10-08. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-107333 | High | 8.1 | 2026-10-08 | Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer… |
CVE-2026-90456 | High | 8.1 | 2026-09-11 | An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment… |
CVE-2026-107362 | High | 7.1 | 2026-10-08 | Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files… |
CVE-2026-107337 | High | 7.1 | 2026-10-08 | The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force… |
CVE-2026-107336 | Medium | 6.5 | 2026-10-08 | Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A re… |
CVE-2026-107335 | Medium | 6.5 | 2026-10-08 | Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting containe… |
CVE-2026-90449 | Medium | 6.5 | 2026-09-11 | When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that in… |
CVE-2026-90448 | Medium | 6.5 | 2026-09-11 | A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which reques… |
CVE-2026-90457 | Medium | 6.2 | 2026-09-11 | The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file contain… |
CVE-2026-90451 | Medium | 5.9 | 2026-09-11 | An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis com… |
CVE-2026-107334 | Medium | 5.4 | 2026-10-08 | Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin… |
CVE-2026-90452 | Medium | 5.3 | 2026-09-11 | Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provide… |
CVE-2026-90454 | Medium | 4.3 | 2026-09-11 | A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but… |
CVE-2026-90450 | Medium | 4.3 | 2026-09-11 | The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather… |
CVE-2026-107361 | Medium | 4.2 | 2026-10-08 | The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime… |
CVE-2026-90455 | Low | 3.7 | 2026-09-11 | A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerab… |
CVE-2026-90453 | Low | 3.5 | 2026-09-11 | A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it again… |