CVE-2026-90452: falha de média gravidade em CISA Malcolm
Improper certificate validation in Malcolm
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6epss 0.1%
Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the identity provider and issue forged authentication tokens accepted by the deployment.
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
CISA · MalcolmCVEs relacionadas — CISA Malcolm
No mesmo produto, das mais perigosas para as menos.
CVE-2026-107333HIGHIncorrect Authorization in MalcolmEPSS 1.2%CVE-2026-107335MEDIUMImproper Handling of Highly Compressed Data in MalcolmEPSS 0.5%CVE-2026-107362HIGHServer-Side Request Forgery in MalcolmEPSS 0.4%CVE-2026-90445HIGHPath Traversal in MalcolmEPSS 0.3%CVE-2026-90444HIGHOS Command Injection in MalcolmEPSS 0.3%CVE-2026-90456CRITICALUse of default credentials in MalcolmEPSS 0.3%