This vulnerability arises when the reverse proxy in CISA Malcolm, configured with a particular authentication mode, bypasses its own authentication checks for requests targeting a bundled third-party administrative interface. The administrative interface manages the credential store that gates access to all other services. Access control is fully delegated to the third-party interface's login mechanism, meaning any authentication weaknesses there directly threaten the credential store's security and, by extension, the entire deployment.

If exploited, an attacker could bypass the gateway's authentication by targeting the third-party administrative interface directly. Since this interface controls the credential store for the deployment, compromising it could lead to unauthorized access to credentials that protect all other services, potentially undermining the entire system's security. However, no known exploits are reported in the wild.

No official patch or fix is currently available. Users should monitor vendor advisories for updates. Until a fix is released, carefully evaluate the authentication mode configuration and consider restricting access to the third-party administrative interface through network controls or additional authentication layers where possible.