CISA Malcolm
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
beschreibt (15)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-90457US | — | — | ||
The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is writ… | ||||
| CVE-2026-90456US | —OT erhöht | — | ||
An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this exa… | ||||
| CVE-2026-90455US | — | — | ||
A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerable version into a log… | ||||
| CVE-2026-90454US | —OT erhöht | — | ||
A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits rou… | ||||
| CVE-2026-90453US | — | — | ||
A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's… | ||||
| CVE-2026-90452US | — | — | ||
Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificat… | ||||
| CVE-2026-90451US | —OT erhöht | — | ||
An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment… | ||||
| CVE-2026-90450US | —OT erhöht | — | ||
The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to de… | ||||
| CVE-2026-90449US | —OT erhöht | — | ||
When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without apply… | ||||
| CVE-2026-90448US | —OT erhöht | — | ||
A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed… | ||||
| CVE-2026-90447US | — | — | ||
A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any pr… | ||||
| CVE-2026-90446US | — | — | ||
An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics d… | ||||
| CVE-2026-90445US | — | — | ||
An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended d… | ||||
| CVE-2026-90444US | — | — | ||
A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and… | ||||
| CVE-2026-90443US | — | — | ||
A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- ICSA Advisory ICSA-26-254-01 JSONself
- ICSA Advisory ICSA-26-254-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (16)
- MitigationMalcolm
The fix for this issue introduces a KEYCLOAK_SSL_VERIFY configuration variable but does not enable certificate validation by default. In addition to updating to the latest version of Malcolm, affected users should explicitly set KEYCLOAK_SSL_VERIFY to enable certificate validation, particularly in deployments where the identity provider is not co-located on a fully trusted network segment.
- BehobenMalcolm
The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.
- BehobenMalcolm
The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.
- BehobenMalcolm
The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.
- BehobenMalcolm
The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.
- BehobenMalcolm
The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.
- BehobenMalcolm
The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.
- BehobenMalcolm
The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.
- BehobenMalcolm
The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.
- BehobenMalcolm
The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.
- BehobenMalcolm
The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.
- BehobenMalcolm
The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.
- BehobenMalcolm
The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.
- BehobenMalcolm
The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.
- BehobenMalcolm
The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.
- BehobenMalcolm
The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan