CVE-2026-107336: CWE-290 Authentication bypass by spoofing in CISA Malcolm

Malcolm's front nginx reverse proxy defines a 'Dashboards → Arkime shortcut' location using a case-insensitive regex matcher but a case-sensitive rewrite. Requests with path segments not in exact lowercase (e.g., /IDDASH2ARK/...) match the location but evade the rewrite, causing nginx to proxy the request to the Arkime backend without authentication. The proxied location lacks per-location authentication, and the proxy forwards the client-supplied X-Forwarded-User header unaltered. Since Arkime trusts this header as the authenticated username, an unauthenticated network caller can supply a forged identity and gain unauthorized access to Arkime.

An attacker can bypass authentication controls and access the Arkime backend with a forged identity by exploiting the mismatch between case-insensitive matching and case-sensitive rewriting in the nginx proxy configuration. This results in unauthorized access with limited confidentiality and integrity impact as per the CVSS score, but no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should review and correct the nginx reverse proxy configuration to ensure consistent case handling between matching and rewriting, and ensure that authentication is enforced on all proxied locations. Additionally, Arkime should not trust client-supplied X-Forwarded-User headers without proper validation.