CVE-2026-107361: falha de média gravidade em CISA Malcolm
Authentication Bypass Using an Alternate Path or Channel in Malcolm
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.2epss 0.2%
The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-creates users with full access. The passwordSecret is hardcoded to the public value "Malcolm". A network-adjacent attacker bypasses nginx entirely by connecting directly to port 8005 with a forged identity header.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
CISA · MalcolmCVEs relacionadas — CISA Malcolm
No mesmo produto, das mais perigosas para as menos.
CVE-2026-107333HIGHIncorrect Authorization in MalcolmEPSS 1.2%CVE-2026-107335MEDIUMImproper Handling of Highly Compressed Data in MalcolmEPSS 0.5%CVE-2026-107362HIGHServer-Side Request Forgery in MalcolmEPSS 0.4%CVE-2026-90445HIGHPath Traversal in MalcolmEPSS 0.3%CVE-2026-90444HIGHOS Command Injection in MalcolmEPSS 0.3%CVE-2026-90456CRITICALUse of default credentials in MalcolmEPSS 0.3%