CVE-2026-107336

Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (the matcher fires) but evades the rewrite (no redirect is issued), so nginx falls through to the location's proxy_pass to the Arkime backend. That location is the one proxied location in the shipped config that does not include the per-location authentication file, so the request reaches Arkime unauthenticated. The same location also forwards a client-supplied X-Forwarded-User header un-overwritten, and Arkime is configured to trust X-Forwarded-User as the authenticated username — so an unauthenticated network caller can reach the Arkime backend while supplying a forged, auto-provisioned identity.

• CWE-290
• CWE-441
• CWE-863

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json
• https://github.com/cisagov/Malcolm/security/advisories/GHSA-7j32-cf27-cp6h

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107325Improper validation of a BSON array length in the MongoDB Go…5.9
• CVE-2026-10733GitLab has remediated an issue in GitLab CE/EE affecting all…4.3
• CVE-2026-107332Insecure file permissions in the CodeCatalyst connection han…5.5
• CVE-2026-107333Malcolm's nginx based reverse proxy contains a URL path norm…8.1
• CVE-2026-107334Malcolm's nginx Lua role-based access control (RBAC) layer d…5.4
• CVE-2026-107335Malcolm's upload-processing pipeline (scripts/safe-extract.p…6.5
• CVE-2026-107337The Malcolm kiosk Flask application exposes a POST /script_c…7.1
• CVE-2026-10734The Infility Global plugin for WordPress is vulnerable to St…7.2
• CVE-2026-10735Multiple Shapedsmart-post-show-pro WordPress plugin before 4…7.5
• CVE-2026-107352Missing authorization checks in Amazon Athena engine version…7.7
• CVE-2026-107353traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0…6.5
• CVE-2026-107354Rejected reason: ** This candidate has been removed by an or…