CVE-2026-90450: Incorrect Authorization in Malcolm
The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user regardless of their assigned role, and any newly added handler is fail-open by default until explicitly added to the table.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Malcolmto a version that resolves this vulnerability.Fixed in September 2026 or later
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user can reach request handlers that are not explicitly registered in the role-requirements table, regardless of their assigned role.
Which parts of the application are affected?
The issue affects any request handler missing from the role-authorization lookup table. Newly added handlers are also accessible by default until they are explicitly added to that table.
What can be done if a patch is not immediately available?
Review all request handlers and explicitly register their required roles in the authorization table. Ensure handlers without an intended public role requirement are denied rather than allowed by default.