Description (CNA)
Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (the matcher fires) but evades the rewrite (no redirect is issued), so nginx falls through to the location's proxy_pass to the Arkime backend. That location is the one proxied location in the shipped config that does not include the per-location authentication file, so the request reaches Arkime unauthenticated. The same location also forwards a client-supplied X-Forwarded-User header un-overwritten, and Arkime is configured to trust X-Forwarded-User as the authenticated username — so an unauthenticated network caller can reach the Arkime backend while supplying a forged, auto-provisioned identity.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| CISA / Malcolm | affected 0 through 26.07.1; unaffected 26.08.0 |
CWE
CWE-290, CWE-441, CWE-863
References
- https://github.com/cisagov/Malcolm/security/advisories/GHSA-7j32-cf27-cp6h
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json
ADP enrichment
No English description supplied.
No references supplied.