The vulnerability exists because an API endpoint in CISA Malcolm accepts user-supplied input and directly uses it in the path of backend requests to the search and analytics data store without restricting or validating the input. This enables an authenticated attacker to manipulate the backend path, causing the application to use its elevated service credentials to access internal endpoints that should be restricted. The attacker could enumerate or read sensitive internal configuration and administrative data from the backend data store.

An authenticated attacker can leverage this SSRF vulnerability to access internal backend endpoints with elevated service credentials, potentially exposing sensitive configuration and administrative data that should be protected. This could lead to information disclosure within the internal network environment.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor advisory for updates. In the meantime, restrict access to the affected API endpoint to trusted users only and consider network-level controls to limit backend service access. Avoid exposing the vulnerable API publicly until a fix is released.