CISA Malcolm patches multiple auth-bypass flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Seven vulnerabilities in CISA's Malcolm network traffic analysis tool allow unauthenticated backend access, RBAC bypass, SSRF, and CSRF-driven forensic data wipe; patched in v26.08.0.
CISA published an ICS advisory covering seven vulnerabilities in Malcolm, an open-source network traffic analysis tool used across energy, IT, and water/wastewater sectors worldwide. The flaws stem from inconsistencies between Malcolm's nginx reverse proxy, its Lua-based RBAC layer, and backend services (Arkime, FilePond). Key issues include a case-sensitivity mismatch that lets unauthenticated callers reach the Arkime backend with a forged identity header (CVE-2026-107336), a directly exposed Arkime live-capture port with a hardcoded passwordSecret and open trust of X-Forwarded-User (CVE-2026-107361), percent-encoding and path-normalization mismatches that let authenticated low-privilege users bypass RBAC to reach admin endpoints (CVE-2026-107333, CVE-2026-107334), an SSRF in the bundled FilePond PHP server allowing arbitrary URL fetch and readback (CVE-2026-107362), and two CSRF issues — one allowing an attacker to trigger a full wipe of captured traffic/forensic logs or stop monitoring via an unauthenticated kiosk endpoint with wildcard CORS (CVE-2026-107337), and another enabling a decompression-bomb upload that exhausts shared storage used by OpenSearch, Logstash, Arkime, and Zeek (CVE-2026-107335).
All issues affect Malcolm versions ≤v26.07.1 and are fixed in v26.08.0. The vulnerabilities chain authentication-trust assumptions (header spoofing, hardcoded secrets, inconsistent URL parsing between proxy layers) rather than memory corruption, making detection and patch verification straightforward: confirm upgrade to v26.08.0, verify nginx/Arkime configs no longer trust unauthenticated X-Forwarded-User headers, and check that arkime-live is not exposed outside intended network boundaries.
CISA states no known public exploitation has been reported. Given Malcolm's role as the forensic/monitoring backbone in ICS and OT-adjacent environments, successful exploitation (especially the forced data-wipe and full auth bypass) could blind defenders during an incident, making prompt patching a priority despite the absence of active exploitation.
Mentioned in this report
Detection guidance
Web Request With Encoded Path Traversal or Double-Encoded Slashes (Proxy/RBAC Bypass)
Detects requests whose path contains percent-encoded dot-segments or slashes, or double-encoding. This is the URL-parsing mismatch used to slip past reverse-proxy RBAC to admin or destructive endpoints, as in the Malcolm nginx/Lua RBAC bypasses. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Request With Encoded Path Traversal or Double-Encoded Slashes (Proxy/RBAC
Bypass)
id: bf942151-1665-55ef-be1c-9cde63d315a1
status: experimental
description: Detects HTTP requests whose path carries percent-encoded dot segments,
encoded slashes/backslashes or double-encoding. Such normalisation mismatches between
a reverse proxy and backend let low-privilege or unauthenticated callers reach admin
endpoints (for example the Malcolm nginx/Lua RBAC bypasses that can lead to data
wipe). Matches the technique pattern, not a specific endpoint.
tags:
- attack.impact
- attack.t1485
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains:
- '%2e%2e%2f'
- '%2e%2e/'
- ..%2f
- '%252e%252e'
- '%252f'
- '%255c'
- '%2e%2e%5c'
condition: selection
falsepositives:
- Web applications or API clients that legitimately pass encoded paths or URLs as
path segments
- Vulnerability scanners run by the security team
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01
FilePond Fetch Endpoint Used for SSRF to Internal or Metadata Addresses
Detects requests to a FilePond-style fetch parameter pointing at loopback, link-local or internal hostnames, the SSRF pattern against the bundled FilePond PHP server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FilePond Fetch Endpoint Used for SSRF to Internal or Metadata Addresses
id: 22d80e0e-b054-5a29-8dc1-d8c152fd6ed0
status: experimental
description: Detects web requests carrying a fetch= query parameter whose value targets
loopback, link-local/cloud-metadata or localhost addresses. This matches the arbitrary
URL fetch and readback SSRF in FilePond PHP servers, as bundled with Malcolm, which
can be used to reach internal-only backends.
tags:
- attack.impact
- attack.t1485
- attack.discovery
logsource:
category: webserver
detection:
selection_param:
cs-uri-query|contains: fetch=
selection_target:
cs-uri-query|contains:
- 127.0.0.1
- localhost
- 169.254.169.254
- '%2f%2f127.'
- '[::1]'
- 0.0.0.0
condition: selection_param and selection_target
falsepositives:
- Developers testing a FilePond fetch feature against a local instance
- Internal vulnerability scanning
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs