CISA Malcolm

1. Executive summary

CISA published ICSA-26-254-01 on 2026-10-01 covering 14 vulnerabilities in Malcolm, the agency's own open-source network traffic analysis suite, affecting versions below v26.06.0. The most severe is an authenticated OS command injection in the file-transfer interface rated CVSS v3.1 8.8 HIGH (CVSS v4.0 8.7 HIGH), which lets an authenticated attacker run arbitrary commands with the privileges of the processing process, read and modify ingested log data, and use the host as a foothold for lateral movement. A separate default-credential flaw in a bundled inventory-management component carries CVSS v4.0 9.2 CRITICAL (v3.1 8.1 HIGH), and a missing-authentication flaw on a bundled administrative interface exposes the credential store that gates every other service in the deployment. CISA states no known public exploitation specifically targeting these vulnerabilities has been reported at this time, and no CVE in this advisory appears in CISA KEV. The risk to EMEA financial services is concentrated in SOC, network-forensics and threat-hunting teams running Malcolm on internal network segments: a compromised Malcolm instance sits inside the monitoring path and can be used to tamper with the evidence a bank relies on for incident response and regulatory reporting.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 28	Malcolm is third-party software (CISA-published, open source) deployed inside the ICT environment; the advisory requires a vendor-fix decision and, for the certificate-validation flaw, an explicit configuration change (`KEYCLOAK_SSL_VERIFY`) that the vendor fix does not enable by default	Firms must apply the same third-party risk treatment to this component as to commercial ICT providers, including tracking the fix state and the residual configuration gap
DORA Art. 17	The command-injection and path-traversal flaws allow an authenticated attacker to read and modify ingested log data and inject fabricated records into stored data	If a Malcolm instance is compromised, the integrity of the log data feeding the firm's ICT incident management process is in question, and the incident-handling process must account for evidence tampering
NIS2 Art. 21(2)(d)	The affected product is a monitoring component in the firm's own supply chain, and the vendor fix leaves a security-relevant setting disabled by default	Entities in scope must treat the unset `KEYCLOAK_SSL_VERIFY` default as a supply-chain security gap to close, not just a patch to apply

No DORA Art. 18, 19, 24, 29 or 30 trigger, and no NIS2 Art. 23 or UK NIS 2018 trigger, is directly engaged by this item on the facts provided. CISA reports no known public exploitation, so the incident-reporting thresholds in DORA Art. 19 and NIS2 Art. 23 are not met by the advisory itself; they would be engaged only if a firm observes exploitation in its own environment.

3. Technical analysis & attack chain

CISA published ICSA-26-254-01 on 2026-10-01 as revision 2 of an advisory first issued 2026-09-11. The advisory covers 14 distinct vulnerabilities in Malcolm, all fixed in the September 2026 release (v26.06.0 or later). The advisory assigns a single headline CVSS v3 score of 8.8 to the set. CISA states no known public exploitation specifically targeting these vulnerabilities has been reported to the agency at this time.

The confirmed attack chain for the highest-severity issue, the OS command injection (CVE-2026-90444, CVSS v3.1 8.8 HIGH, CVSS v4.0 8.7 HIGH, CWE-78):

The attacker authenticates to the file-transfer interface, which requires valid credentials.
The attacker uploads a file whose name contains shell metacharacters. The interface accepts attacker-controlled filenames without restricting those characters.
An automated process later constructs and runs a system command using the uploaded file's name.
The embedded command executes with the privileges of that process.
The attacker can read and modify ingested log data, and can use the resulting access as a foothold for further movement within the internal network.

The remaining vulnerabilities, grouped by the mechanism CISA describes:

Unauthenticated web interface (CVE-2026-90443, CVSS v3.1 5.4 MEDIUM, CVSS v4.0 5.3 MEDIUM, CWE-79). A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. An unauthenticated network attacker can craft a link that, when visited by a user, executes arbitrary script in the context of the affected application and can redirect the browser to an arbitrary external site. Successful exploitation lets the attacker act with the compromised user's session privileges.

Archive extraction path traversal (CVE-2026-90445, CVSS v3.1 6.5 MEDIUM, CVSS v4.0 7.1 HIGH, CWE-22). An interface that accepts uploads from authenticated users extracts archive contents without validating that extracted paths stay within the destination directory. An authenticated attacker can craft an archive whose entries traverse outside the destination, writing files to arbitrary locations with the privileges of the extraction process. This can inject fabricated records into stored data or tamper with application configuration.

Backend path injection via API (CVE-2026-90446, CVSS v3.1 4.3 MEDIUM, CVSS v4.0 5.3 MEDIUM, CWE-918). An API endpoint interpolates a user-supplied value directly into the path of a backend request to the underlying search and analytics data store. An authenticated attacker can substitute an arbitrary backend path, causing the application's own elevated service credentials to be used against unintended internal endpoints, and can enumerate or read internal configuration and administrative data otherwise restricted.

Authentication bypass by header spoofing (CVE-2026-90447, CVSS v3.1 6.5 MEDIUM, CVSS v4.0 7.1 HIGH, CWE-290). A routing rule selects between two authentication mechanisms for the same downstream service based on a client-supplied request header. An authenticated user with a shared service credential can set that header to route around the primary role-based authorization check and reach the alternate path's fixed, elevated role, performing actions reserved for a higher-privileged role.

Missing authorization on read-only deployments (CVE-2026-90448, CVSS v3.1 6.5 MEDIUM, CVSS v4.0 7.1 HIGH, CWE-862). A read-only deployment mode proxies API routes without restricting request methods. One route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifier, using the application's own elevated backend credentials. An authenticated user on a deployment intended to be read-only can forge or overwrite stored records.

Missing authentication for a critical function (CVE-2026-90449, CVSS v3.1 6.5 MEDIUM, CVSS v4.0 6.9 MEDIUM, CWE-306). When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this interface, which manages the credential store gating every other service in the deployment, is delegated to the third-party interface's own login. Any authentication weakness in that bundled interface compromises the credential store protecting the rest of the deployment.

Fail-open role authorization (CVE-2026-90450, CVSS v3.1 4.3 MEDIUM, CVSS v4.0 5.3 MEDIUM, CWE-863). The role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements. Any handler not explicitly registered is reachable by any authenticated user regardless of role, and any newly added handler is fail-open by default until explicitly added to the table.

Default signing secret for a bundled component (CVE-2026-90451, CVSS v3.1 5.9 MEDIUM, CVSS v4.0 8.2 HIGH, CWE-1392). An example environment-configuration file ships with a fixed, publicly-known secret used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies the example file into active configuration without running the setup routine that regenerates the value uses the known default, allowing an attacker aware of the default to forge valid authentication cookies for that component.

Improper certificate validation (CVE-2026-90452, CVSS v3.1 5.3 MEDIUM, CVSS v4.0 6.0 MEDIUM, CWE-295). Requests from the reverse proxy to the identity-provider service for token discovery, introspection and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider can impersonate the identity provider and issue forged authentication tokens accepted by the deployment. The fix introduces a KEYCLOAK_SSL_VERIFY configuration variable but does not enable certificate validation by default; CISA states affected users should explicitly set KEYCLOAK_SSL_VERIFY to enable validation, particularly where the identity provider is not co-located on a fully trusted network segment.

Open redirect (CVE-2026-90453, CVSS v3.1 3.5 LOW, CVSS v4.0 5.1 MEDIUM, CWE-601). A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. An authenticated attacker can craft a request that redirects another user's browser to an arbitrary external destination after an upload.

Missing authorization on tag-modifying routes (CVE-2026-90454, CVSS v3.1 4.3 MEDIUM, CVSS v4.0 5.3 MEDIUM, CWE-862). A read-only deployment mode denies write-capable routes by pattern, but the pattern omits routes that modify tags on stored session records, and the proxy configuration permits the request method those routes use. An authenticated user on a read-only deployment can add or remove tags on stored session records.

Reintroduced vulnerable dependency (CVE-2026-90455, CVSS v3.1 3.7 LOW, CVSS v4.0 6.3 MEDIUM, CWE-1395). A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier version into a log-processing component. CISA states the only code path in that component using the library issues a request to a single fixed, trusted vendor URL at initialization and does not process attacker-controlled input through the library, which limits practical exploitability in this context.

Default administrative password for a bundled component (CVE-2026-90456, CVSS v3.1 8.1 HIGH, CVSS v4.0 9.2 CRITICAL, CWE-1392). An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies the example file into active configuration without running the setup routine that regenerates credentials exposes that component's administrative interface to anyone aware of the default value.

Weak password hashing with world-readable hash file (CVE-2026-90457, CVSS v3.1 6.2 MEDIUM, CVSS v4.0 6.9 MEDIUM, CWE-916). The administrative password is hashed with a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing any local user to read it. This is inconsistent with a separate, stronger algorithm used for the same password on another path. A party able to read the file, including a local user or a party with access to a configuration backup, could feasibly recover the password through offline computation, compromising the administrative credential across every path that accepts it.

Confidence caveat. The CVE identifiers above are taken from the related CISA advisory page (external-1). The primary item text supplied to Adverse Trace does not itself carry CVE identifiers, and the VERIFIED REFERENCE DATA block for this item is empty, so no CVSS score, severity or CISA KEV state in this advisory has been independently re-assessed. The scores and severities are CISA's own as published. CISA states no known public exploitation has been reported; that is a point-in-time statement from the vendor and should be re-checked before relying on it for prioritisation.

Related prior advisory. A separate CISA advisory, ICSA-26-230-01, covers an earlier Malcolm patch cycle fixed in v26.07.0 and v26.06.1, including CVE-2026-63133, CVE-2026-63134, CVE-2026-63177 and CVE-2026-55676. The v26.06.1 fix addresses an unrestricted file upload in the FilePond PHP backend at POST /server/php/submit.php, where the allow-list at file-upload/php/config.php:16 is an empty array by default, uploaded files land in /var/www/upload/server/php/files (file-upload/php/config.php:7), and an authenticated GET /server/php/files/.php executes uploaded code as www-data. The v26.07.0 fix addresses unbounded archive extraction in safe-extract.py and a raw os.makedirs(os.path.join(dest, entry.pathname)) call with no traversal protection. Firms running Malcolm below v26.06.0 are exposed to both advisory sets and should treat the September 2026 release as the single remediation target.

4. Mitigation & containment

P1 (within 24 hours)

Identify every Malcolm instance in the estate and record its version. Anything below v26.06.0 is in scope for both this advisory and ICSA-26-230-01. Anything below v26.07.0 is in scope for the earlier advisory set.
Upgrade to the September 2026 release (v26.06.0 or later) or the latest available version. CISA names no intermediate workaround for the command-injection or missing-authentication flaws; the vendor fix is the remediation.
Set KEYCLOAK_SSL_VERIFY explicitly to enable certificate validation. The vendor fix introduces the variable but does not enable validation by default. This is a required configuration step, not an optional hardening measure, and it matters most where the identity provider is not co-located on a fully trusted network segment.
Check whether the example environment-configuration files were copied into active configuration without running the setup routine. If so, the bundled packet-analysis component's cookie-signing secret and the bundled inventory-management component's administrative password are the publicly-known defaults. Regenerate both through the setup routine, or rotate them manually if the setup routine cannot be re-run.
Restrict network access to Malcolm's web, file-transfer and API interfaces to the management network. The command-injection flaw requires authentication, but the XSS flaw does not, and the missing-authentication flaw on the bundled administrative interface is reachable without the gateway's own authentication when the affected mode is configured.

P2 (within 72 hours)

Audit the permissions on the credential-store file holding the administrative password hash. The advisory states the file is written with permissions allowing any local user to read it. Restrict it to the service account that needs it, and check configuration backups for the same file.
Review role assignments on every Malcolm instance. The fail-open authorization flaw means any request handler not explicitly registered in the role-requirements table is reachable by any authenticated user. Enumerate the handlers in use and confirm each is registered.
Where Malcolm runs in a read-only deployment mode, verify that the proxy configuration restricts request methods, not just route patterns. The advisory describes two separate flaws where a route-pattern deny list omitted write-capable routes.
Rotate the shared service credential referenced in the authentication-bypass-by-spoofing flaw. Any authenticated user holding it can set the routing header and reach the elevated role.

P3 (within 7 days)

Confirm the bundled HTTP client library version in the log-processing component. The advisory states a prior remediation was reverted, reintroducing the vulnerable version. CISA assesses practical exploitability as limited because the only code path using the library calls a single fixed trusted vendor URL at initialization, but the version should still be tracked and corrected at the next release.
Review whether Malcolm log data feeds any incident-response or regulatory-reporting process. If it does, and if any instance was exposed to an untrusted network while unpatched, treat the integrity of that data as suspect and cross-check against an independent source.
Re-check CISA's advisory page for revision updates. The advisory is already at revision 2, and CISA has not published a CISA KEV entry or a remediation due date for any CVE in this set.

5. Indicators of compromise

No indicators of compromise available in the source material. The CISA advisory describes vulnerability mechanisms and affected versions but publishes no file hashes, network indicators, filenames or registry keys.

The sources do describe observable behaviours that defenders can hunt for. These are not atomic indicators and are not suitable for automated blocking.

Behavioural indicators

behaviour	where to observe	confidence
Uploaded file with shell metacharacters in the filename reaching the file-transfer interface	Malcolm file-transfer interface logs, upload directory contents	high, CISA describes the mechanism directly
System command constructed from an uploaded file's name and executed by a processing process	Process creation telemetry on the Malcolm host, parent process is the Malcolm processing service	high, CISA describes the mechanism directly
Archive extraction writing files outside the intended destination directory	Filesystem write telemetry, extraction process audit logs	high, CISA describes the mechanism directly
API request with a user-supplied value interpolated into a backend search-and-analytics path	Malcolm API access logs, backend data store request logs	high, CISA describes the mechanism directly
Request header set to select the alternate authentication path for a downstream service	Reverse proxy access logs, authentication service logs	high, CISA describes the mechanism directly
Record creation or overwrite on a deployment configured as read-only	Backend data store write logs, Malcolm audit logs	high, CISA describes the mechanism directly
Authentication cookie for the bundled packet-analysis component signed with the shipped default secret	Authentication service logs, cookie validation failures	high, CISA describes the mechanism directly
Forged authentication tokens accepted after identity-provider impersonation on the proxy-to-IdP path	Identity provider logs, token issuance logs, network path telemetry	medium, requires an on-path attacker and is not directly observable from logs alone
Browser redirect to an external destination after a file upload, driven by the `Referer` header	Reverse proxy access logs, browser-side telemetry	high, CISA describes the mechanism directly
Tag additions or removals on stored session records on a read-only deployment	Backend data store write logs	high, CISA describes the mechanism directly
Administrative login to the bundled inventory-management component using the shipped default password	Component authentication logs	high, CISA describes the mechanism directly

6. Detection

The sources give no file hashes, no command-line strings, no mutex names, no scheduled-task names and no registry keys. They do give distinctive file paths, an HTTP endpoint and a configuration variable. The YARA rule below uses the file paths and endpoint from the related ICSA-26-230-01 advisory, which describes the same product and the same code paths. The Sigma rule targets the process and network behaviours CISA describes for the command-injection and SSRF flaws.

rule Malcolm_FileUpload_And_Extraction_Artifacts
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-01"
        reference = "https://www.cisa.gov/news-events/ics-advisories/icsa-26-254-01"
        reference2 = "https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01"
        description = "Detects Malcolm file-upload and archive-extraction code paths associated with CVE-2026-55676, CVE-2026-90444 and CVE-2026-90445. These are source and configuration artefacts of the affected product, not of a specific exploit."
    strings:
        $p1 = "/var/www/upload/server/php/files" ascii
        $p2 = "file-upload/php/config.php" ascii
        $p3 = "/server/php/submit.php" ascii
        $p4 = "safe-extract.py" ascii
        $p5 = "os.makedirs(os.path.join(dest, entry.pathname))" ascii
        $p6 = "KEYCLOAK_SSL_VERIFY" ascii
    condition:
        2 of them
}

title: Malcolm Processing Process Spawning Shell From Uploaded Filename
id: 8f3c1a72-4b6e-4d21-9c0a-7e5d2b1f9a44
status: experimental
description: Detects a shell or command interpreter spawned by the Malcolm processing service, consistent with the OS command injection described in CISA ICSA-26-254-01 (CVE-2026-90444). The advisory states an automated process constructs and runs a system command using an uploaded file's name.
references:

    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-254-01
author: Adverse Trace
date: 2026-10-01
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith:

            - '/filebeat'
            - '/safe-extract.py'
            - '/python3'
    selection_child:
        Image|endswith:

            - '/sh'
            - '/bash'
            - '/dash'
    selection_cmd:
        CommandLine|contains:

            - 'safe-extract'
            - '/var/www/upload/server/php/files'
    condition: selection_parent and selection_child and selection_cmd
falsepositives:

    - Legitimate maintenance scripts run by the Malcolm processing service
level: high

title: Malcolm API Backend Path Injection Attempt
id: 2a9d4c18-6e7b-4f03-b5a1-3c8e9d0f7b21
status: experimental
description: Detects requests to the Malcolm API carrying path-traversal or absolute-path sequences in a parameter that is interpolated into a backend search-and-analytics request path, consistent with CISA ICSA-26-254-01 (CVE-2026-90446).
references:

    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-254-01
author: Adverse Trace
date: 2026-10-01
logsource:
    category: webserver
detection:
    selection_method:
        cs-method:

            - 'GET'
            - 'POST'
    selection_path:
        cs-uri-query|contains:

            - '../'
            - '..%2f'
            - '%2e%2e%2f'
            - 'http://'
            - 'https://'
    condition: selection_method and selection_path
falsepositives:

    - Legitimate API clients passing encoded paths
level: medium

7. Sources

CISA, "CISA Malcolm", ICSA-26-254-01, published 2026-09-11, updated 2026-10-01. https://www.cisa.gov/news-events/ics-advisories/icsa-26-254-01
CISA, "CISA Malcolm", ICSA-26-230-01, related prior advisory covering the v26.06.1 and v26.07.0 fixes. https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01
CISA, "Notification", referenced in the advisory. https://www.cisa.gov/notification
CISA, "Privacy & Use policy", referenced in the advisory. https://www.cisa.gov/privacy-policy
CISA, "ICS-TIP-12-146-01B: Targeted Cyber Intrusion Detection and Mitigation Strategies", referenced in the advisory. https://www.cisa.gov/ics
CISA, "Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies", referenced in the advisory. https://www.cisa.gov/ics
CISA, Malcolm pull request 1043, referenced in ICSA-26-230-01. https://github.com/cisagov/Malcolm/pull/1043
CISA, Malcolm pull request 1026, referenced in ICSA-26-230-01. https://github.com/cisagov/Malcolm/pull/1026

8. Adverse Trace position

Adverse Trace assesses this as a high-priority patch item for any EMEA financial services client running Malcolm, with the caveat that the VERIFIED REFERENCE DATA block for this item is empty and no CVE in the set appears in CISA KEV. The scores and severities in this advisory are CISA's own as published, and CISA states no known public exploitation has been reported. The command-injection flaw at CVSS v3.1 8.8 HIGH is the operational priority because it gives an authenticated attacker command execution with the privileges of the processing process and a foothold for lateral movement inside the monitoring path. The default-credential flaw at CVSS v4.0 9.2 CRITICAL is the priority for exposure review because it requires only that an example configuration file was copied into active use without running the setup routine, which is a common deployment shortcut. The certificate-validation flaw is the one item where the vendor fix alone is insufficient: KEYCLOAK_SSL_VERIFY must be set explicitly. We will track CISA's advisory page for further revisions and for any CISA KEV addition, and we will re-issue this advisory if either changes. Clients running Malcolm below v26.06.0 should treat the September 2026 release as the remediation target for both this advisory and ICSA-26-230-01, and should confirm the KEYCLOAK_SSL_VERIFY setting and the default-credential rotation as separate line items rather than assuming the upgrade closes them.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.