CVE-2026-90449: Security vulnerability
When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which manages the credential store used to gate every other service in the deployment, is delegated entirely to that third-party interface's own login mechanism. Any authentication weakness in that bundled interface would compromise the credential store protecting the rest of the deployment.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Malcolmto a version that resolves this vulnerability.Fixed in September 2026 or later - Compensating control
If a particular authentication mode is configured, ensure the reverse proxy does not forward requests for the bundled third-party administrative interface directly to that interface without applying the gateway’s own authentication requirement first; enforce the gateway authentication requirement before forwarding.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the particular authentication mode that forwards requests for the bundled third-party administrative interface directly to that interface are exposed. The provided information does not identify whether this mode is enabled by default.
What would an attacker need to compromise the broader deployment?
An attacker would need to exploit an authentication weakness in the bundled third-party administrative interface. Its access controls are solely responsible for protecting the credential store in this configuration.
What is the potential impact if the administrative interface is compromised?
Compromise could expose or control the credential store used to gate every other service in the deployment. This can undermine authentication protection beyond the administrative interface itself.