CVE-2026-90450: Security vulnerability
The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user regardless of their assigned role, and any newly added handler is fail-open by default until explicitly added to the table.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Malcolmto a version that resolves this vulnerability.Fixed in September 2026 or later - Configuration
Configure Malcolm so that request handlers that are not explicitly registered are not reachable by authenticated users; and ensure the role-authorization lookup defaults to deny (rather than grant) when a request handler's name is not present in its table of role requirements.
Malcolm request handler registration / role authorization lookup default access for unregistered handlers / handlers not present in role requirements table = deny (do not grant access when handler name is not present) - Configuration
Ensure newly added request handlers are not fail-open by default; newly added handlers should be inaccessible until explicitly registered in the handler-to-role requirements table.
Malcolm handler registration behavior fail-open default for newly added request handlers = fail-closed (do not allow until explicitly added)
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user can reach request handlers that are not explicitly registered in the role-requirements table, regardless of their assigned role.
Which parts of the application are affected?
The issue affects any request handler missing from the role-authorization lookup table. Newly added handlers are also accessible by default until they are explicitly added to that table.
What can be done if a patch is not immediately available?
Review all request handlers and explicitly register their required roles in the authorization table. Ensure handlers without an intended public role requirement are denied rather than allowed by default.