EUVD-2026-95115
GHSA-c366-pv2g-9685
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Remote unauthenticated request against default config (AV:N/AC:L/PR:N/UI:N); yields read access and a forged trusted identity (C:L/I:L), no availability impact (A:N).
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
1DescriptionCVE.org
Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (the matcher fires) but evades the rewrite (no redirect is issued), so nginx falls through to the location's proxy_pass to the Arkime backend. That location is the one proxied location in the shipped config that does not include the per-location authentication file, so the request reaches Arkime unauthenticated. The same location also forwards a client-supplied X-Forwarded-User header un-overwritten, and Arkime is configured to trust X-Forwarded-User as the authenticated username - so an unauthenticated network caller can reach the Arkime backend while supplying a forged, auto-provisioned identity.
AnalysisAI
Authentication bypass in CISA Malcolm's shipped front nginx reverse proxy lets unauthenticated remote attackers reach the Arkime backend and assume arbitrary identities by requesting the 'Dashboards -> Arkime shortcut' path with any path segment that is not exact-lowercase (for example /IDDASH2ARK/...). The location's case-insensitive regex matcher fires, but the case-sensitive rewrite does not issue the intended redirect, so nginx falls through to the one proxied location in the shipped configuration that omits the per-location authentication file; that same location also forwards a client-supplied X-Forwarded-User header un-overwritten, and Arkime is configured as shipped to trust that header as the authenticated username, enabling forged, auto-provisioned identities. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target run Malcolm's shipped front nginx reverse-proxy configuration containing the 'Dashboards → Arkime shortcut' location, with Arkime configured (as shipped) to trust the X-Forwarded-User header as the authenticated username. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine authentication-bypass flaw (CWE-290) whose practical risk is moderate and well-characterized by the data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix referenced by the GitHub Security Advisory GHSA-7j32-cf27-cp6h and CISA ICS advisory ICSA-26-280-01 as soon as a patched Malcolm release is available; a released patched version could not be independently confirmed from the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authenticated users holding only the granular ROLE_UPLOAD permission in CISA's Malcolm network traffic analysis suite ca
Unbounded archive extraction in Malcolm, CISA's network traffic analysis tool suite, allows a user who can reach the arc
Authorization bypass in Malcolm (all versions prior to 26.07.0) allows authenticated low-privilege users to access restr
Malcolm, CISA's open-source network traffic analysis platform, ships an nginx-based reverse proxy whose Lua RBAC authori
Path traversal in Malcolm's archive extraction logic allows authenticated low-privilege users to create arbitrary direct
Cross-site request forgery in the CISA Malcolm network traffic analysis platform lets a remote attacker who lures the op
Server-side request forgery (SSRF) in the Malcolm file-upload component allows authenticated low-privilege attackers to
Malcolm's upload-processing pipeline allows an authenticated user with PCAP/log upload rights to exhaust the shared Dock
Incorrect authorization in CISA Malcolm allows an authenticated low-privilege user to reach admin-only paths by percent-
Authentication bypass in CISA's Malcolm network traffic analysis platform lets any host with network adjacency to the Ma
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today