> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CISA Malcolm - URL: https://f4n6.co.uk/security-feed/cisa-malcolm-3/ - Published: 2026-10-15T22:56:38.000Z - Updated: 2026-10-15T22:56:38.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-107336, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334 ## 1\. Executive summary CISA published ICSA-26-280-01 on 2026-10-15 covering seven vulnerabilities in Malcolm, the open-source network traffic analysis suite used to capture and inspect PCAP and Zeek/Arkime data. The highest-rated issue is CVE-2026-107333 at CVSS 8.1 HIGH (CWE-863, incorrect authorization), a URL path normalization inconsistency between Malcolm's nginx Lua RBAC layer and nginx's own routing that lets an authenticated low-privilege user reach admin-gated endpoints. None of the seven CVEs is in CISA KEV, and EPSS is 0% for six of them and 1% for CVE-2026-107333, so there is no evidence of exploitation in the wild at the time of writing. The risk to EMEA financial services is concentrated in two places: any SOC or network-forensics team running Malcolm to inspect traffic, where CVE-2026-107361 exposes Arkime on port 8005 with a hardcoded password secret and CVE-2026-107337 lets a CSRF wipe captured traffic and forensic logs, and any environment where Malcolm sits on a shared Docker volume, where CVE-2026-107335 lets an authenticated uploader exhaust that volume and take the platform down for everyone. The fix is a version upgrade, not a configuration change: v26.08.0 closes five of the seven, v26.09.0 closes the remaining two. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 28 | Malcolm is a third-party open-source tool deployed in the client's own monitoring stack, and the fix depends on the vendor's release cadence (v26.08.0 and v26.09.0) rather than on the client's own code. | The client must be able to evidence that it tracks upstream security releases for this component and applies them within a defined window. Where Malcolm is used to monitor regulated production traffic, its availability is part of the ICT third-party risk register. | | DORA Art. 30 | CVE-2026-107361 ships a hardcoded password secret ("Malcolm") and trusts the X-Forwarded-User header from any IP, both of which are vendor-side defaults the client cannot fix by configuration alone. | Contractual provisions with the supplier should cover the vendor's obligation to disclose and remediate security defects in shipped defaults, and the client's right to be notified of them. | | NIS2 Art. 21(2)(d) | The affected component is a security monitoring tool, so a compromise of it degrades the client's own detection capability rather than only exposing a business application. | Supply chain security measures must extend to the security tooling itself, including how it is patched and how its own exposure is monitored. | No DORA Art. 17, 18, 19 or 24 row is included: nothing in this item indicates an incident has occurred at a client, so the incident-management and reporting articles are not engaged by the facts as published. ## 3\. Technical analysis & attack chain Malcolm is a network traffic analysis suite. The affected releases are v26.07.1 and earlier for CVE-2026-107336, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335 and CVE-2026-107334, and v26.08.0 and earlier for CVE-2026-107333 and CVE-2026-107362\. CISA reports no known public exploitation of any of the seven. The chain below is the one an unauthenticated network caller can walk, combining CVE-2026-107336 and CVE-2026-107361\. Both are confirmed in the CISA advisory. 1. The attacker sends a request to the Malcolm front nginx reverse proxy with a path segment that is not exact-lowercase, for example `/IDDASH2ARK/...`. The location block for the "Dashboards to Arkime shortcut" uses a case-insensitive regex matcher but a case-sensitive rewrite, so the matcher fires and the request enters the location, but the rewrite does not, and no redirect is issued. 2. nginx falls through to the location's `proxy_pass` to the Arkime backend. That location is the only proxied location in the shipped configuration that does not include the per-location authentication file, so the request reaches Arkime without authentication. 3. The same location forwards a client-supplied `X-Forwarded-User` header without overwriting it. Arkime is configured to trust `X-Forwarded-User` as the authenticated username, so the attacker supplies a forged identity and Arkime auto-provisions it. 4. Separately, and without touching nginx at all, an attacker with network adjacency can connect directly to port 8005\. The `arkime-live` service runs with `network_mode: host`, exposing port 8005 on all interfaces (`viewHost=0.0.0.0`). Arkime trusts `X-Forwarded-User` from any address (`userAuthIps=::,0.0.0.0/0`) and auto-creates users with full access. The `passwordSecret` is hardcoded to the public value "Malcolm". A forged identity header on a direct connection to 8005 is sufficient. Two further issues are reachable by an authenticated user and matter because they let a low-privilege account escalate or destroy evidence. CVE-2026-107333 (CVSS 8.1 HIGH, CWE-863) is the same class of flaw as CVE-2026-107334 but with a wider blast radius. The nginx Lua RBAC layer and nginx's own request routing disagree on URL path normalization. An authenticated user crafts a specially formatted request path and reaches administrative or role-gated endpoints they should not have access to. CISA states this affects all restricted paths protected by the RBAC layer, including file upload, the PHP server, htadmin, and authentication management interfaces. This is the highest-scored item in the set and the one to patch first. CVE-2026-107334 (CVSS 5.4 MEDIUM, CWE-863) is the narrower variant. The Lua RBAC layer pattern-matches the raw, percent-encoded request URI, while nginx selects the location block using the percent-decoded, normalized URI. Because the RBAC check never percent-decodes its input, a low-privilege user requests an admin-only path using percent-encoding, for example `/%68tadmin.php`, and nginx routes it to the restricted location while the Lua gate sees no matching restriction and grants access. The affected paths named by CISA are `/htadmin`, `/auth`, `/admin_login`, `/arkime/api/esadmin`, NetBox, and the upload endpoints. CVE-2026-107337 (CVSS 7.1 HIGH, CWE-352) is a CSRF issue in the Malcolm kiosk Flask application. The `POST /script_call/` endpoint has no authentication and the application is configured with wildcard CORS (`CORS(app)`). An attacker who can get an operator's browser to issue the request can force execution of arbitrary management commands, including `control.py --wipe`, which permanently deletes all captured network traffic and forensic logs, and `control.py --stop`, which stops the capture and blinds monitoring. The forensic consequence is the point: the tool that would have recorded the intrusion is the tool that erases the record. CVE-2026-107362 (CVSS 7.1 HIGH, CWE-918) is an SSRF in the file-upload component. Malcolm ships the upstream FilePond PHP server (`pqina/filepond-server-php`) largely unmodified: the Dockerfile copies all upstream `*.php` files and Malcolm only overwrites `config.php` and `submit.php`. The upstream `index.php` exposes a fetch API route that instructs the server to download an arbitrary URL with curl, including `FOLLOWLOCATION`. For HEAD requests, the fetched response body is stored in the upload container's transfer directory and the transfer ID is returned to the caller, which allows full readback of the fetched content. This is a server-side request forgery with a readback primitive, so it can be used to reach internal services and retrieve their responses. CVE-2026-107335 (CVSS 6.5 MEDIUM, CWE-409) is a decompression amplification issue. `scripts/safe-extract.py` enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip, tar, rar, 7z via libarchive), but those limits are not applied when the uploaded file is a single-stream compressed format (`.gz`, `.bz2`, `.xz`, `.lzma`, `.lz`) that is not a `.tar.*`\-style archive. Any authenticated user permitted to upload PCAP or log files can upload a small, highly compressible file, for example a gzip bomb, that decompresses to an effectively unbounded size on disk. The shared Docker volume used by OpenSearch, Logstash, Arkime and Zeek fills, and the platform is disrupted for all users. This is a denial of service against the monitoring stack, not a data breach. CVE-2026-107361 (CVSS 4.2 MEDIUM, CWE-288) is the direct-to-port-8005 authentication bypass described in step 4 above. Its score is low because it requires network adjacency, but on a flat internal network or a monitoring VLAN that is reachable from a compromised host, adjacency is the normal condition. CVE-2026-107336 (CVSS 6.5 MEDIUM, CWE-290) is the nginx case-sensitivity bypass described in steps 1 to 3. Remediation is split across two releases. CISA states that CVE-2026-107336, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335 and CVE-2026-107334 were patched in Malcolm v26.08.0, and that CVE-2026-107333 and CVE-2026-107362 were patched in Malcolm v26.09.0\. Upgrading to v26.09.0 or later therefore closes all seven. Confidence caveat: this advisory is drawn from a single CISA ICS advisory (ICSA-26-280-01). The technical descriptions are detailed and internally consistent, but no independent vendor analysis or exploitation telemetry corroborates them. The absence of KEV listing and the 0% to 1% EPSS scores are consistent with no observed exploitation, and that is the state as published, not a guarantee. Treat the version-to-CVE mapping as single-sourced and verify against the CISA advisory and the Malcolm release notes before scheduling the upgrade. ## 4\. Mitigation & containment P1 (within 24 hours) - Upgrade Malcolm to v26.09.0 or later. This is the only action that closes all seven CVEs. v26.08.0 closes five; v26.09.0 closes CVE-2026-107333 and CVE-2026-107362 as well. If a staged upgrade is unavoidable, move to v26.08.0 first and treat v26.09.0 as the immediate follow-on. - Block direct access to TCP port 8005 from anything other than the Malcolm host itself. CVE-2026-107361 is exploitable by any host that can reach 8005, because `arkime-live` runs with `network_mode: host` and Arkime trusts `X-Forwarded-User` from `0.0.0.0/0`. A host firewall rule or a network ACL on the monitoring VLAN is the containment step that does not wait for the upgrade. - If Malcolm is reachable from the internet or from a business network, remove that exposure now. CISA's recommended practice is to keep control system devices off the internet and behind a firewall, isolated from business networks. Malcolm captures traffic and holds forensic logs; it should not be internet-facing. - Change the Arkime `passwordSecret` away from the hardcoded default "Malcolm" if the deployment has not already done so, and confirm that `userAuthIps` is not left at `::,0.0.0.0/0` after the upgrade. P2 (within 72 hours) - Restrict the kiosk Flask application so that `POST /script_call/` is not reachable from operator browsers on untrusted origins. CVE-2026-107337 depends on wildcard CORS and an unauthenticated endpoint; until the upgrade lands, network-level restriction of the kiosk interface removes the CSRF path. - Audit which accounts hold upload permission. CVE-2026-107335 requires an authenticated user permitted to upload PCAP or log files, and CVE-2026-107333 and CVE-2026-107334 require an authenticated low-privilege account. Reduce the number of accounts that can upload, and review role assignments against the RBAC roles in use. - Check the shared Docker volume used by OpenSearch, Logstash, Arkime and Zeek for unexpected growth or a large number of small files, which is the observable effect of a decompression bomb under CVE-2026-107335. - Review nginx access logs for requests to the Arkime shortcut location with non-lowercase path segments, for example `/IDDASH2ARK/`, and for percent-encoded admin paths such as `/%68tadmin.php`. These are the request shapes for CVE-2026-107336 and CVE-2026-107334. P3 (within 7 days) - Review whether the file-upload component's upstream FilePond PHP files are needed at all in the deployment. CVE-2026-107362 exists because Malcolm copies all upstream `*.php` files and only overwrites `config.php` and `submit.php`; removing or blocking the upstream `index.php` fetch route removes the SSRF primitive independently of the version upgrade. - Confirm that egress from the Malcolm host is restricted. CVE-2026-107362 uses curl with `FOLLOWLOCATION` to fetch an arbitrary URL, so an egress allow-list limits what the SSRF can reach. - Verify that captured traffic and forensic logs are retained somewhere other than the Malcolm volume alone. CVE-2026-107337 can permanently delete them via `control.py --wipe`, and CVE-2026-107335 can exhaust the volume they sit on. ## 5\. Indicators of compromise No atomic indicators of compromise are available in the source material. The CISA advisory describes vulnerable configurations and request shapes, not attacker infrastructure, file hashes, or domains. The following behavioural indicators are derived from the advisory's technical descriptions and are useful for hunting in Malcolm's own logs. | Behaviour | Where to observe | Confidence | | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ | --------------------------------------------- | | Request to the Arkime shortcut location with a non-lowercase path segment, for example /IDDASH2ARK/... | nginx access log on the Malcolm front proxy | Medium, single-sourced to CISA ICSA-26-280-01 | | Request to an admin-only path using percent-encoding, for example /%68tadmin.php | nginx access log, and the Lua RBAC layer's decision log if enabled | Medium, single-sourced to CISA ICSA-26-280-01 | | Direct connection to TCP port 8005 from an address other than the Malcolm host | Host firewall or network flow logs for the monitoring VLAN | Medium, single-sourced to CISA ICSA-26-280-01 | | X-Forwarded-User header arriving from an unexpected source address, or a username that was not previously provisioned | nginx access log, Arkime user list | Medium, single-sourced to CISA ICSA-26-280-01 | | POST /script\_call/ with a management command argument, including control.py --wipe or control.py --stop | Kiosk Flask application log | Medium, single-sourced to CISA ICSA-26-280-01 | | Upload of a single-stream compressed file (.gz, .bz2, .xz, .lzma, .lz) that is not a .tar.\* archive, followed by rapid growth of the shared Docker volume | Upload component log, host disk metrics | Medium, single-sourced to CISA ICSA-26-280-01 | | Outbound HTTP request from the upload container to an internal or unexpected URL, with the response body stored in the transfer directory | Egress firewall logs, upload container filesystem | Medium, single-sourced to CISA ICSA-26-280-01 | ## 6\. Detection The advisory gives distinctive request shapes and command strings. A YARA rule is not a good fit here because the artefacts are HTTP request paths and management command arguments rather than file content, so the detection below is a Sigma rule matching the nginx access log and the kiosk application log. The strings are taken verbatim from the CISA advisory. ```yaml title: Malcolm Exploitation Attempts (CVE-2026-107336, CVE-2026-107334, CVE-2026-107337) id: 7f3a1c62-9d84-4b21-a5e0-2c6b8f1d4a90 status: experimental description: Detects request patterns and management command invocations described in CISA ICSA-26-280-01 for CISA Malcolm. Covers the nginx case-sensitivity authentication bypass, the percent-encoded RBAC bypass, and the unauthenticated kiosk script_call endpoint. author: Adverse Trace date: 2026-10-15 references: - https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01 logsource: category: webserver detection: selection_arkime_shortcut: cs-uri-stem|contains: 'IDDASH2ARK' selection_percent_encoded_admin: cs-uri-stem|contains: - '/%68tadmin' - '/%61uth' - '/%61dmin_login' selection_kiosk_script_call: cs-uri-stem|contains: '/script_call/' cs-method: 'POST' selection_wipe_or_stop: cs-uri-query|contains: - 'control.py --wipe' - 'control.py --stop' condition: selection_arkime_shortcut or selection_percent_encoded_admin or selection_kiosk_script_call or selection_wipe_or_stop falsepositives: - Legitimate administrative use of the kiosk script_call endpoint by an operator - Percent-encoded paths generated by a proxy or client that normalises URLs differently from nginx level: high ``` Two notes on the rule. The `IDDASH2ARK` match is case-sensitive in intent: the bypass depends on the path segment not being exact-lowercase, so a case-insensitive log search will also match legitimate lowercase traffic and should be narrowed at the SIEM. The percent-encoded admin paths are matched on the encoded form because that is the form the RBAC layer fails to decode; a normalising proxy may rewrite them before they reach the log, in which case the rule will not fire and the nginx location routing should be reviewed directly. ## CVE assessment 7 referenced CVEs | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | -------- | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-107333](https://nvd.nist.gov/vuln/detail/CVE-2026-107333?ref=f4n6.co.uk) | 8.1 High | — | 1% | Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access con… | | [CVE-2026-107337](https://nvd.nist.gov/vuln/detail/CVE-2026-107337?ref=f4n6.co.uk) | 7.1 High | — | 0% | The Malcolm kiosk Flask application exposes a POST /script\_call/ |