CVE-2026-91002: Missing Authentication in stamparm maltrail
CVE-2026-91002 is a medium severity vulnerability in stamparm maltrail up to version 3.0.1. It affects the _blacklist function in the core/httpd.py file, allowing remote attackers to bypass authentication. The issue was fixed in version 3.1 by requiring authenticated sessions or using the Blacklist_ALLOWLIST option.
AI Analysis
Technical Summary
This vulnerability involves missing authentication in the _blacklist function of the Blacklist Endpoint component in stamparm maltrail versions 3.0.0 and 3.0.1. An attacker can remotely exploit this weakness to access the endpoint without authentication. The vendor addressed the issue promptly by releasing version 3.1, which gates the endpoint behind an authenticated session or the new Blacklist_ALLOWLIST option. The fix corresponds to patch d95868dff3da4d3bd4f942837a26cb7c73a797ae.
Potential Impact
The vulnerability allows unauthenticated remote attackers to access the Blacklist Endpoint, potentially leading to unauthorized manipulation of blacklist data. This could undermine the integrity or intended operation of the maltrail system. The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector and no required privileges or user interaction.
Mitigation Recommendations
Upgrade stamparm maltrail to version 3.1 or later. This version includes an official fix that enforces authentication on the affected endpoint or enables the Blacklist_ALLOWLIST option to restrict access. No other mitigation is necessary as the vendor fixed the issue on the same day it was reported.
CVE-2026-91002: Missing Authentication in stamparm maltrail
Description
CVE-2026-91002 is a medium severity vulnerability in stamparm maltrail up to version 3.0.1. It affects the _blacklist function in the core/httpd.py file, allowing remote attackers to bypass authentication. The issue was fixed in version 3.1 by requiring authenticated sessions or using the Blacklist_ALLOWLIST option.
CVSS v4.0
Score 6.9medium
Affected software
stamparm
maltrail
pkg:github/stamparm/maltrailcpe:2.3:a:stamparm:maltrail:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves missing authentication in the _blacklist function of the Blacklist Endpoint component in stamparm maltrail versions 3.0.0 and 3.0.1. An attacker can remotely exploit this weakness to access the endpoint without authentication. The vendor addressed the issue promptly by releasing version 3.1, which gates the endpoint behind an authenticated session or the new Blacklist_ALLOWLIST option. The fix corresponds to patch d95868dff3da4d3bd4f942837a26cb7c73a797ae.
Potential Impact
The vulnerability allows unauthenticated remote attackers to access the Blacklist Endpoint, potentially leading to unauthorized manipulation of blacklist data. This could undermine the integrity or intended operation of the maltrail system. The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector and no required privileges or user interaction.
Mitigation Recommendations
Upgrade stamparm maltrail to version 3.1 or later. This version includes an official fix that enforces authentication on the affected endpoint or enables the Blacklist_ALLOWLIST option to restrict access. No other mitigation is necessary as the vendor fixed the issue on the same day it was reported.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-14T15:38:40.042Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa8dbe455bf5e2cf53a12d8
Added to database: 09/15/2026, 05:47:16 UTC
Last enriched: 09/15/2026, 06:01:27 UTC
Last updated: 09/15/2026, 06:54:01 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.