CVE-2026-90449: Missing Authentication for Critical Function in Malcolm
When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which manages the credential store used to gate every other service in the deployment, is delegated entirely to that third-party interface's own login mechanism. Any authentication weakness in that bundled interface would compromise the credential store protecting the rest of the deployment.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the particular authentication mode that forwards requests for the bundled third-party administrative interface directly to that interface are exposed. The provided information does not identify whether this mode is enabled by default.
What would an attacker need to compromise the broader deployment?
An attacker would need to exploit an authentication weakness in the bundled third-party administrative interface. Its access controls are solely responsible for protecting the credential store in this configuration.
What is the potential impact if the administrative interface is compromised?
Compromise could expose or control the credential store used to gate every other service in the deployment. This can undermine authentication protection beyond the administrative interface itself.