CVE-2026-107334 is an incorrect authorization vulnerability in the role-based access control (RBAC) implementation of CISA Malcolm's nginx Lua layer. The vulnerability arises because the RBAC check uses the raw, percent-encoded request URI, while nginx routes requests based on the percent-decoded URI. This discrepancy allows an authenticated low-privilege user to access admin-only paths by using percent-encoded variants of restricted URLs, bypassing the RBAC restrictions.
CVE-2026-107335 is a vulnerability in CISA Malcolm affecting versions from 0 up to and including 26.07.1. The issue involves improper handling of highly compressed single-stream files (e.g., .gz, .bz2) that are not tar-style archives. Authenticated users with upload permissions can upload small, highly compressible files that decompress to very large sizes, causing resource exhaustion on the shared Docker volume and disrupting the platform. The vulnerability has a CVSS score of 6.5 and is classified as medium severity.
CVE-2026-107337 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability in the Malcolm kiosk Flask application by CISA. The application exposes a POST endpoint /script_call/<script> without any authentication and uses wildcard CORS, allowing attackers to trick an operator's browser into executing arbitrary management commands. Exploitation can lead to destructive actions such as permanently deleting all captured network traffic and forensic logs or stopping security monitoring. This vulnerability affects Malcolm versions from 0 up to and including 26.07.1.
CVE-2026-107361 is an authentication bypass vulnerability in the Arkime live capture service (arkime-live) component of CISA Malcolm. The service runs in host network mode exposing port 8005 on all interfaces and trusts the X-Forwarded-User header from any IP address, automatically creating users with full access. The passwordSecret is hardcoded to a public value "Malcolm", allowing a network-adjacent attacker to bypass nginx and authenticate by connecting directly to port 8005 with a forged identity header. This vulnerability affects Malcolm versions up to and including 26.07.1.
CVE-2026-107362 is a server-side request forgery (SSRF) vulnerability in the Malcolm platform's file-upload component, specifically in the bundled FilePond PHP server. Authenticated users can exploit this flaw to make the server fetch arbitrary URLs over HTTP, HTTPS, or FTP and receive the response, potentially exposing internal resources accessible from the upload container. This affects Malcolm versions from 0 up to and including 26.07.1.
CVE-2026-107333 is a high-severity vulnerability in CISA Malcolm's nginx-based reverse proxy. It arises from a URL path normalization inconsistency between the Lua-based RBAC authorization layer and nginx's request routing logic. This flaw allows an authenticated user to bypass role-based access controls and access administrative or restricted endpoints, including file upload, PHP server, htadmin, and authentication management interfaces. The vulnerability affects all restricted paths protected by the RBAC layer in Malcolm versions from 0 up to and including 26.07.1.
CVE-2026-107336 is an authentication bypass vulnerability in CISA Malcolm's nginx reverse proxy configuration. The issue arises because a case-insensitive regex matcher allows requests with non-lowercase path segments to bypass a case-sensitive rewrite, leading to unauthenticated access to the Arkime backend. Additionally, the proxy forwards a client-supplied X-Forwarded-User header without overwriting it, and Arkime trusts this header for authentication. This combination allows an unauthenticated attacker to access Arkime with a forged identity.
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized `ngx.var.request_uri`, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example `/x/../upload/...`) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue.
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protects file extraction with libarchive's secure flags, but creates directory entries with a raw `os.makedirs(os.path.join(dest, entry.pathname))` that has no traversal protection. An uploaded malicious archive containing a directory entry with a `../` sequence or an absolute path causes the filebeat processing container to create directories outside the intended extraction directory. Version 26.07.0 fixes the issue.
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat processing container to create an unbounded number of filesystem objects, exhausting inodes or filesystem metadata and denying service to the processing pipeline and any service sharing the same mount. Version 26.07.0 fixes the issue.
Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) accepts uploads at `POST /server/php/submit.php` and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array by default (`file-upload/php/config.php:16`), so the type check is a no-op and every extension is accepted. The filename sanitizer keeps the `.php` extension intact. Committed files land in `/var/www/upload/server/php/files` (`file-upload/php/config.php:7`), and the component's nginx routes any URL ending in `.php` to php-fpm. An authenticated `GET /server/php/files/<name>.php` then executes the uploaded code as `www-data`. Prior to version 26.06.1, in RBAC mode, the upload endpoint is reachable by the granular `ROLE_UPLOAD` role (`nginx/lua/nginx_auth_helpers.lua:71`), a role intended only for submitting capture files. As a result, a user holding the upload-only role runs arbitrary PHP as `www-data` inside the file-upload container. Version 26.06.1 fixes the issue.