EUVD-2026-95119
GHSA-9jvx-84p5-48xr
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Forging a trusted header is trivial (AC:L), requires no auth (PR:N) but only network adjacency to the host-mode port (AV:A); full viewer access exposes sensitive captured traffic (C:H) and allows user creation (I:L).
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
1DescriptionCVE.org
The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-creates users with full access. The passwordSecret is hardcoded to the public value "Malcolm". A network-adjacent attacker bypasses nginx entirely by connecting directly to port 8005 with a forged identity header.
AnalysisAI
Authentication bypass in CISA's Malcolm network traffic analysis platform lets any host with network adjacency to the Malcolm deployment reach the bundled Arkime live-capture service directly on TCP port 8005 and impersonate arbitrary users, gaining full administrative access to the Arkime viewer. The issue stems from documented default configuration: the arkime-live container runs with network_mode: host and binds the viewer to 0.0.0.0 (viewHost), Arkime trusts the X-Forwarded-User header from any source IP (userAuthIps=::,0.0.0.0/0) with automatic user creation, and the passwordSecret is the hardcoded public value 'Malcolm'. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Malcolm Arkime live-capture container to be deployed with its documented defaults: network_mode: host binding the viewer on 8005 across all interfaces (viewHost=0.0.0.0), Arkime configured to trust X-Forwarded-User from any IP (userAuthIps=::,0.0.0.0/0) with auto-user-creation, and the hardcoded passwordSecret 'Malcolm'. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority issue, not a top-tier emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix referenced in the vendor advisory GHSA-86h3-7rf8-8j34 / ICSA-26-280-01 by updating to a patched Malcolm release (the provided intelligence does not specify a fixed version number, so confirm the target version against CISA's advisory before upgrading), and in the interim harden the three defaults that make this exploitable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authenticated users holding only the granular ROLE_UPLOAD permission in CISA's Malcolm network traffic analysis suite ca
Unbounded archive extraction in Malcolm, CISA's network traffic analysis tool suite, allows a user who can reach the arc
Authorization bypass in Malcolm (all versions prior to 26.07.0) allows authenticated low-privilege users to access restr
Malcolm, CISA's open-source network traffic analysis platform, ships an nginx-based reverse proxy whose Lua RBAC authori
Path traversal in Malcolm's archive extraction logic allows authenticated low-privilege users to create arbitrary direct
Cross-site request forgery in the CISA Malcolm network traffic analysis platform lets a remote attacker who lures the op
Server-side request forgery (SSRF) in the Malcolm file-upload component allows authenticated low-privilege attackers to
Malcolm's upload-processing pipeline allows an authenticated user with PCAP/log upload rights to exhaust the shared Dock
Authentication bypass in CISA Malcolm's shipped front nginx reverse proxy lets unauthenticated remote attackers reach th
Incorrect authorization in CISA Malcolm allows an authenticated low-privilege user to reach admin-only paths by percent-
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today