CVE-2026-107361

Name of the Vulnerable Software and Affected Versions Malcolm (affected versions not specified)

Description The Arkime live capture service (arkime-live) within Malcolm is configured with network mode: host, which exposes port 8005 across all network interfaces via viewHost=0.0.0.0. The service is configured to trust the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and automatically creates users with full access. Additionally, the passwordSecret is hardcoded to the public value "Malcolm". A network-adjacent attacker can bypass the nginx proxy by connecting directly to port 8005 using a forged identity header.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.