CVE-2026-90454: Security vulnerability
A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request method those routes use. This allows an authenticated user on a deployment intended to be read-only to add or remove tags on stored session records.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Malcolmto a version that resolves this vulnerability.Fixed in September 2026 or later
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can access the bundled packet-analysis component through a deployment configured for read-only exposure can exploit it. The issue affects stored session records that the user is able to reach through the exposed interface.
What access and request capability does exploitation require?
The attacker must be authenticated and able to send the HTTP method accepted by the proxy configuration for the tag-modification routes. No additional access requirement is stated.
Are read-only deployments fully protected by the intended route restrictions?
No. The deny pattern omits routes used to add or remove tags, while the proxy otherwise permits the method used by those routes.
How can I determine whether a deployment is affected?
Review the proxy's read-only route-deny pattern and confirm whether routes that modify tags on stored session records are excluded from that pattern. Also verify whether the proxy permits the request method used by those routes.