CISA Malcolm Authentication Bypass Flaws Expose Network Analysis Deployments

As reported by CISA in advisory ICSA-26-280-01, six vulnerabilities have been disclosed in CISA Malcolm, the open-source network traffic analysis and visualization platform widely deployed across energy, water, and IT critical infrastructure sectors. The aggregate CVSS v3 score of 8.1 (High) underscores the severity of this batch — several of these flaws chain together to enable unauthenticated access to sensitive network monitoring backends.

Vulnerability Summary

Why This Matters

The most concerning vulnerability in this set is CVE-2026-107336, which exploits a classic case-sensitivity mismatch between nginx's regex location matcher and its rewrite directive. An attacker can craft a URL path like /IDDASH2ARK/... — matching the case-insensitive location block but evading the case-sensitive rewrite that would normally redirect to the authenticated dashboard. The request falls through directly to the Arkime backend without authentication, and because the proxy forwards a client-supplied X-Forwarded-User header that Arkime trusts, the attacker gains a forged identity with auto-provisioned access.

This is a textbook example of how proxy misconfiguration undermines authentication layers — a pattern we see repeatedly in self-hosted security tooling where the reverse proxy and application backend disagree on trust boundaries.

CVE-2026-107333 is equally significant: it enables authenticated users to bypass role-based access control by exploiting URL path normalization inconsistencies between nginx's Lua-based RBAC layer and nginx's native routing logic. In environments where Malcolm is exposed to analysts with limited privileges, this flaw could allow privilege escalation to administrative functions.

Who Is at Risk

• ICS/OT environments — Malcolm is specifically designed for industrial network monitoring; energy, water, and manufacturing sectors are the primary deployment targets
• Self-hosted security operations — organizations running Malcolm on their own infrastructure without network-level access controls
• Multi-tenant analyst teams — where RBAC bypass (CVE-2026-107333) enables lateral movement between analyst tiers
• Internet-exposed deployments — though Malcolm is typically internal, any exposure amplifies the authentication bypass risk significantly

Shield53 Recommendations

Immediate Actions:

• Upgrade to the latest Malcolm release — CISA indicates v26.08.0 patches CVE-2026-107336 and earlier flaws. However, CVE-2026-107333 and CVE-2026-107362 affect versions through v26.08.0, so monitor for a subsequent release addressing those remaining issues
• Restrict network access — ensure Malcolm's nginx proxy is not reachable from untrusted networks. Place it behind a VPN or jump host with MFA
• Audit Arkime trust configuration — verify that X-Forwarded-User header trust is properly scoped and not accepting arbitrary client-supplied values
• Review proxy rules — for any organization running custom nginx configurations over Arkime or similar backends, audit for case-sensitivity mismatches between location matchers and rewrites
• Deploy WAF or reverse proxy filtering — strip unexpected case variations and normalize paths before they reach the Malcolm proxy
• Monitor logs for exploitation indicators — look for non-lowercase path segments hitting /iddash2ark/ or similar dashboard shortcut locations, and for RBAC bypass attempts using path normalization tricks

Notably, CVE-2026-107333 and CVE-2026-107362 affect versions through v26.08.0, meaning even patched installations may still carry residual risk. Organizations should apply compensating controls — particularly network segmentation and strict access controls — until a fully patched version is available. Given Malcolm's role in monitoring critical infrastructure networks, compromise of the tool could expose sensitive traffic patterns, alerting rules, and network topology data that would be valuable to adversarial reconnaissance.