CVE-2026-90456 Use of default credentials in Malcolm
Attackers can access the administrative interface of Malcolm's inventory component if the default example configuration is used without regenerating credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-90456?
CVE-2026-90456 is a critical vulnerability in CISA Malcolm, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that component's administrative interface to anyone aware of the default value.
Weakness: CWE-1392
Which versions are affected by CVE-2026-90456?
How do I fix CVE-2026-90456?
No fix has been published for CVE-2026-90456 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-90456 being exploited?
There is no known exploitation of CVE-2026-90456 in the wild and no public exploit code.
Sources
Also known as GHSA-xvc8-c6gw-4q63.