CVE-2026-107336 Authentication Bypass by Spoofing in Malcolm
Attackers can bypass authentication and forge identities in Malcolm's Arkime backend by exploiting a case-sensitivity mismatch in nginx configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107336?
CVE-2026-107336 is a medium-severity authentication bypass vulnerability in CISA Malcolm, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (the matcher fires) but evades the rewrite (no redirect is issued), so nginx falls through to the location's proxy_pass to the Arkime backend. That location is the one proxied location in the shipped config that does not include the per-location authentication file, so the request reaches Arkime unauthenticated. The same location also forwards a client-supplied X-Forwarded-User header un-overwritten, and Arkime is configured to trust X-Forwarded-User as the authenticated username — so an unauthenticated network caller can reach the Arkime backend while supplying a forged, auto-provisioned identity.
Which versions are affected by CVE-2026-107336?
How do I fix CVE-2026-107336?
No fix has been published for CVE-2026-107336 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-107336 being exploited?
There is no known exploitation of CVE-2026-107336 in the wild and no public exploit code.
Sources
Also known as GHSA-7j32-cf27-cp6h, GHSA-c366-pv2g-9685.