CVE-2026-107361: Authentication Bypass Using an Alternate Path or Channel in Malcolm
The Arkime live capture service (arkime-live) in Malcolm runs with networkmode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-creates users with full access. The passwordSecret is hardcoded to the public value "Malcolm". A network-adjacent attacker bypasses nginx entirely by connecting directly to port 8005 with a forged identity header.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Malcolmto a version that resolves this vulnerability.Fixed in v26.08.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A network-adjacent attacker who can reach port 8005 on a Malcolm host can exploit it. No credentials or user interaction are required, but exploitation requires forging an X-Forwarded-User header.
Is the default deployment configuration affected?
The described Malcolm configuration exposes arkime-live on all network interfaces through host networking and trusts identity headers from any IP address. It also auto-creates users with full access, making direct access to port 8005 sufficient for bypassing nginx.
What can be done if patching is not immediately possible?
Prevent untrusted networks from reaching port 8005 and restrict access to trusted sources only. Do not allow direct connections to arkime-live that bypass nginx.
How can I determine whether a deployment is exposed?
Check whether arkime-live uses host networking and whether port 8005 is reachable on any network interface. Also verify whether viewHost is set to 0.0.0.0, userAuthIps includes :: or 0.0.0.0/0, and the passwordSecret is the public value "Malcolm".