{"id":"CVE-2026-90454","state":"PUBLISHED","title":"Missing authorization in Malcolm","description":"A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request method those routes use. This allows an authenticated user on a deployment intended to be read-only to add or remove tags on stored session records.","publishedAt":"2026-09-11T21:51:42.586Z","updatedAt":"2026-10-02T20:54:31.559Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["CISA Malcolm"],"affected":[{"vendor":"CISA","product":"Malcolm","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v26.06.0","versionType":"custom"},{"version":"v26.06.0","status":"unaffected"}],"repo":"https://github.com/cisagov/Malcolm"}],"references":["https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-254-01.json","https://www.cisa.gov/news-events/ics-advisories/icsa-26-254-01"],"weaknesses":["CWE-862"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/90xxx/CVE-2026-90454.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90454","state":"PUBLISHED","datePublished":"2026-09-11T21:51:42.586Z","dateUpdated":"2026-10-02T20:54:31.559Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2026-09-11T21:00:09.301Z"},"containers":{"cna":{"title":"Missing authorization in Malcolm","descriptions":[{"lang":"en","value":"A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request method those routes use. This allows an authenticated user on a deployment intended to be read-only to add or remove tags on stored session records."}],"affected":[{"vendor":"CISA","product":"Malcolm","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"v26.06.0","versionType":"custom"},{"version":"v26.06.0","status":"unaffected"}],"repo":"https://github.com/cisagov/Malcolm"}],"references":[{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-254-01.json","tags":["government-resource","vendor-advisory"]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-254-01"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","lang":"en","description":"CWE-862 Missing authorization","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2026-10-02T20:54:31.559Z"},"solutions":[{"lang":"en","value":"The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.","supportingMedia":[{"type":"text/html","base64":false,"value":"<div><div>The latest version of Malcolm (September 2026 or later) fixes these vulnerabilities. Affected users are encouraged to update their instance of Malcolm to the latest version.</div></div>"}]}],"source":{"advisory":"ICSA-26-254-01","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-90454","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-14T12:51:43.711866Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-14T13:00:30.302Z"}}]}}}