CVE-2026-90452
mediumpriority · track · 0EPSS 0.001 · 1 %ileUSEPSS · scored 2026-10-27
Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the identity provider and issue forged authentication tokens accepted by the deployment.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedMalcolmcisa_csaf_ot
The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.
- MitigationMalcolmcisa_csaf_ot
The fix for this issue introduces a KEYCLOAK_SSL_VERIFY configuration variable but does not enable certificate validation by default. In addition to updating to the latest version of Malcolm, affected users should explicitly set KEYCLOAK_SSL_VERIFY to enable certificate validation, particularly in deployments where the identity provider is not co-located on a fully trusted network segment.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.3–6
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (1)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-26-254-01CISA Malcolm2026-09-11icsa · cisa_csaf_otUS
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
sources
Which sources assert this record, and when.
references (2) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan