CVE-2026-107336

Name of the Vulnerable Software and Affected Versions Malcolm (affected versions not specified)

Description The front nginx reverse proxy uses a case-insensitive regex matcher for the Dashboards to Arkime shortcut location, but employs a case-sensitive rewrite. If a request path is not in exact lowercase, it bypasses the rewrite and is passed directly to the Arkime backend via proxy pass. Because this specific location lacks the required authentication file, requests reach the backend unauthenticated. Additionally, the proxy forwards the client-supplied X-Forwarded-User header without overwriting it. Since Arkime trusts this header for identity, an unauthenticated attacker can access the backend by forging an auto-provisioned identity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.