CVE-2026-90447: Security vulnerability
A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this header to route around the primary role-based authorization check and reach the alternate path's fixed, elevated role instead. This allows a low-privileged authenticated attacker who knows the shared credential to perform actions reserved for a higher-privileged role.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Malcolmto a version that resolves this vulnerability.Fixed in September 2026 or later
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must be authenticated, have a low-privileged account, possess the shared service credential, and be able to supply the request header used by the routing rule.
Who is exposed to the authorization bypass?
Deployments are exposed where the routing rule chooses the authentication mechanism from a client-controlled request header and the alternate path assigns a fixed elevated role. Low-privileged authenticated users who know the shared credential can potentially reach actions reserved for that elevated role.
How can defenders identify attempted exploitation?
Review requests to the downstream service for the client-supplied header that controls authentication routing, especially when it selects the alternate authentication path. Investigate uses of the shared service credential by low-privileged accounts and any resulting elevated-role actions.