CISA 2026-10-15

CISA Malcolm

Machine-generated analysis · WAYSCloud LLM

Malcolm versions up to v26.07.1 permit unauthenticated access to the Arkime backend via a crafted URL path.

Context

The advisory addresses CISA Malcolm versions <=v26.07.1 (and additional CVEs affect <=v26.08.0). It states that a case-insensitive regex matcher combined with a case-sensitive rewrite in the front nginx reverse proxy can bypass authentication and forward a client-supplied X-Forwarded-User header to Arkime, allowing unauthenticated callers to assume any identity. The vendor has released a fix in Malcolm version v26.08.0.

Operator considerations

Check: Identify Malcolm deployments running version v26.07.1 or earlier.
Patch: Upgrade Malcolm to version v26.08.0 or later, which includes the authentication bypass fix.
Isolate: Restrict network access to the Arkime backend until the upgrade is applied.
Log: Monitor for requests to the Arkime shortcut path that contain X-Forwarded-User headers.

From Cybersecurity and Infrastructure Security Agency ↗

The following versions of CISA Malcolm are affected:

Malcolm

Read the full advisory on CISA →