CVE-2026-90451: CWE-1392 Use of default credentials in CISA Malcolm
An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value will use the known default, allowing an attacker aware of the default to forge valid authentication cookies for that component.
AI Analysis
Technical Summary
This vulnerability arises because the example environment-configuration file for CISA Malcolm includes a fixed secret used to sign authentication cookies. Deployments that copy this example file into active use without running the setup routine to generate a unique secret will use the known default secret. An attacker aware of this default secret can forge valid authentication cookies for the bundled packet-analysis component, potentially gaining unauthorized access.
Potential Impact
An attacker who knows the default secret can forge authentication cookies, allowing unauthorized access to the packet-analysis component within Malcolm. This compromises the authentication mechanism, potentially exposing sensitive packet analysis data or functionality.
Mitigation Recommendations
No official patch or fix is currently documented. The recommended mitigation is to ensure that the setup routine is run during deployment to regenerate the secret value, replacing the default fixed secret. Deployers should avoid using the example environment-configuration file as-is in production environments.
CVE-2026-90451: CWE-1392 Use of default credentials in CISA Malcolm
Description
An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value will use the known default, allowing an attacker aware of the default to forge valid authentication cookies for that component.
CVSS v4.0
Score 8.2high
Affected software
CISA
Malcolm
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises because the example environment-configuration file for CISA Malcolm includes a fixed secret used to sign authentication cookies. Deployments that copy this example file into active use without running the setup routine to generate a unique secret will use the known default secret. An attacker aware of this default secret can forge valid authentication cookies for the bundled packet-analysis component, potentially gaining unauthorized access.
Potential Impact
An attacker who knows the default secret can forge authentication cookies, allowing unauthorized access to the packet-analysis component within Malcolm. This compromises the authentication mechanism, potentially exposing sensitive packet analysis data or functionality.
Mitigation Recommendations
No official patch or fix is currently documented. The recommended mitigation is to ensure that the setup routine is run during deployment to regenerate the secret value, replacing the default fixed secret. Deployers should avoid using the example environment-configuration file as-is in production environments.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- icscert
- Date Reserved
- 2026-09-11T21:00:09.301Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa47a7455bf5e2cf581b19f
Added to database: 09/11/2026, 22:02:28 UTC
Last enriched: 09/11/2026, 22:17:13 UTC
Last updated: 09/11/2026, 22:39:53 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.