CVE-2026-90457: Security vulnerability
The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a separate, stronger hashing algorithm used for the same password on another authentication path. A party able to read this file, including a local user or a party with access to a configuration backup, could feasibly recover the underlying password through offline computation, compromising the administrative credential across every path that accepts it.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Malcolmto a version that resolves this vulnerability.Fixed in September 2026 or later - Configuration
Update the permissions of the file that contains the hashed administrative credential so it is not readable by any local user (restrict read access to only the required privileged users/processes).
Malcolm credential store permissions on file containing administrative password hash = readable by any local user
Event History
Frequently Asked Questions
Who has a plausible path to exploit this issue?
Any local user able to read the affected credential-store file is exposed to this attack path. Parties with access to configuration backups containing that file can also attempt recovery of the administrative password.
Does recovering the password affect only one authentication path?
No. The recovered administrative password can compromise the credential across every authentication path that accepts the same password.
Would an attacker need to interact with the target system while attempting password recovery?
After obtaining the readable hash file, the password can be recovered through offline computation. The described attack therefore depends on access to the file or a backup containing it.