CVE-2026-107361 Authentication Bypass Using an Alternate Path or Channel in Malcolm
Attackers bypass authentication by connecting directly to the Arkime service and forging identity headers, gaining unauthorized access to network data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107361?
CVE-2026-107361 is a medium-severity authentication bypass vulnerability in CISA Malcolm, published on 8 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-creates users with full access. The passwordSecret is hardcoded to the public value "Malcolm". A network-adjacent attacker bypasses nginx entirely by connecting directly to port 8005 with a forged identity header.
Weakness: CWE-288
Which versions are affected by CVE-2026-107361?
How do I fix CVE-2026-107361?
No fix has been published for CVE-2026-107361 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-107361 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-107361 exists.
Sources
Also known as GHSA-86h3-7rf8-8j34, GHSA-9jvx-84p5-48xr.