CVE-2026-107336 CISA CVE debrief

Who should care

Defenders responsible for the security of Malcolm installations should assess their exposure and verify the authenticity of requests to the Arkime backend. They should prioritize verifying the authenticity of requests and ensuring that the X-Forwarded-User header is properly validated. This includes reviewing and updating the nginx configuration to prevent similar vulnerabilities and ensuring that compensating controls are in place for exposed systems.

Why it matters

The vulnerability allows for authentication bypass by spoofing, which can lead to unauthorized access to the Arkime backend. Defenders should prioritize verifying the authenticity of requests and ensuring that the X-Forwarded-User header is properly validated.

• An attacker can reach the Arkime backend unauthenticated
• The X-Forwarded-User header can be forged to auto-provision an identity
• Defenders need to verify the authenticity of requests to the Arkime backend
• Defenders need to ensure that the X-Forwarded-User header is properly validated

Technical summary

The vulnerability is caused by a case-insensitive regex matcher and a case-sensitive rewrite in the front nginx reverse proxy. This allows an attacker to evade authentication and reach the Arkime backend unauthenticated. The vulnerability has a CVSS score of 6.5 and is considered medium severity. The Arkime backend does not include per-location authentication, and the X-Forwarded-User header is trusted as the authenticated username. An attacker can exploit this vulnerability by supplying a forged X-Forwarded-User header to auto-provision an identity.

Defensive priority

Defenders should prioritize verifying the authenticity of requests to the Arkime backend and ensuring that the X-Forwarded-User header is properly validated.

Recommended defensive actions

• Verify the authenticity of requests to the Arkime backend
• Ensure that the X-Forwarded-User header is properly validated
• Review and update the nginx configuration to prevent similar vulnerabilities
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by a case-insensitive regex matcher and a case-sensitive rewrite in the front nginx reverse proxy. This allows an attacker to evade authentication and reach the Arkime backend unauthenticated.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.