CVE-2026-107337: CWE-352 Cross-Site request forgery (CSRF) in CISA Malcolm

The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with no authentication and wildcard CORS configuration. This setup enables an attacker to perform Cross-Site Request Forgery (CWE-352) attacks by forcing an operator's browser to execute arbitrary management commands. Notably, commands like control.py --wipe can permanently delete all captured network traffic and forensic logs, while control.py --stop can disable security monitoring. The vulnerability affects Malcolm versions >=0 and <=26.07.1. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

An attacker can leverage this vulnerability to execute arbitrary management commands via CSRF, leading to high impact outcomes such as permanent deletion of forensic data and disabling of security monitoring. This compromises the integrity and availability of the security monitoring system without requiring authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint, disable or limit CORS wildcard usage, and educate operators to avoid interacting with untrusted web content that could trigger CSRF attacks.