CISA has issued an ICS advisory for its own Malcolm network traffic analysis platform, disclosing five vulnerability classes affecting versions up to v26.08.0, with a top CVSS v3 score of 8.1. The issues include Authentication Bypass by Spoofing, Incorrect Authorization, Authentication Bypass Using an Alternate Path or Channel, SSRF, and CSRF. One flaw (CVE-2026-107336) stems from an nginx reverse proxy misconfiguration where a case-insensitive location matcher paired with a case-sensitive rewrite lets crafted path requests reach the Arkime backend while skipping authentication controls.
For identity and access security, the authentication bypass and incorrect authorization issues are the core concern: they can let an attacker reach protected backend services without valid credentials, undermining access controls on a tool deployed across Energy, IT, and Water/Wastewater critical infrastructure worldwide.
What to take away: organizations running Malcolm should upgrade to a patched release and review reverse-proxy auth enforcement, since case-sensitivity mismatches between matchers and rewrites are a recurring way auth gates get silently bypassed.