ICSA-26-280-01: CISA Malcolm Authentication Bypass and SSRF Flaws (CVE-2026-107336 et al.) — Detection and Remediation Guide

CISA has published ICSA-26-280-01 disclosing seven vulnerabilities in Malcolm, CISA's own open-source network traffic analysis platform that many SOC teams deploy as an ICS/OT sensor stack. The irony is uncomfortable but important: the tool you deployed to watch your network is itself vulnerable to authentication bypass, server-side request forgery (SSRF), cross-site request forgery (CSRF), and a data-amplification condition that can be used to exhaust sensor resources.

The advisory carries a CVSS v3 score of 8.1 (High) and covers two version bands:

• Malcolm v26.07.1 and earlier — CVE-2026-107336, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334
• Malcolm v26.08.0 and earlier — CVE-2026-107333, CVE-2026-107362

Malcolm is deployed worldwide, and CISA's advisory specifically calls out exposure in the Energy, Information Technology, and Water and Wastewater Systems critical infrastructure sectors. If your organization runs Malcolm sensors — particularly internet-reachable or flat-network deployments in OT environments — treat this as an urgent patch cycle. An attacker who compromises the sensor doesn't just blind your visibility; they inherit a privileged vantage point inside the monitoring segment, often with broad network reachability by design.

Technical Analysis

Affected Products and Versions

Malcolm is a containerized stack (Docker/Podman) bundling nginx as a reverse proxy, Arkime for session capture, Zeek and Suricata for network analysis, OpenSearch/Elasticsearch for indexing, Logstash, and several auxiliary web services. All of these ride behind a front-end that, until these fixes, contained weaknesses across its authentication and request-handling layers.

Vulnerability Classes

CWE mappings from the advisory break down as follows:

• Authentication Bypass by Spoofing — an attacker can forge identity assertions accepted by one of the Malcolm web components, gaining authenticated access without valid credentials.
• Incorrect Authorization — authenticated (or spoofed) users can reach functions or data outside their intended privilege level.
• Server-Side Request Forgery (SSRF) — attacker-controlled URLs are fetched by a Malcolm server-side component, allowing the sensor to be used as a pivot to reach internal services, cloud metadata endpoints, or OT segment hosts that should be unreachable to the attacker.
• Authentication Bypass Using an Alternate Path or Channel — backend services (e.g., direct access to Arkime, OpenSearch, or API containers) are reachable without passing through the nginx authentication gate, so the front-end login controls can be sidestepped entirely.
• Cross-Site Request Forgery (CSRF) — missing anti-CSRF protections on state-changing operations allow an attacker to coerce a logged-in analyst's browser into performing unwanted actions against the Malcolm console.
• Improper Handling of Highly Compressed Data (Data Amplification) — processing of crafted compressed inputs can consume disproportionate CPU/memory, enabling denial of service against the capture or indexing pipeline — effectively blinding the sensor at the moment an attacker needs cover.

Attack Chain from a Defender's Perspective

The most dangerous realistic chain is: alternate-path auth bypass or spoofing → SSRF → lateral movement into the monitored segment. Malcolm sensors are deliberately placed where they can see everything — SPAN/TAP feeds, management networks, sometimes dual-homed between IT and OT monitoring zones. An unauthenticated attacker who reaches a Malcolm component and abuses SSRF can turn the sensor into a proxy for scanning and attacking hosts that network segmentation was supposed to protect. The data-amplification weakness compounds this: an adversary executing a targeted intrusion can simultaneously degrade the sensor's ability to record it.

Exploitation Status

As of the advisory publication, CISA has not reported confirmed in-the-wild exploitation, and none of these CVEs are listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing. However, Malcolm is public, widely deployed, and its architecture is fully documented — the gap between advisory and working exploit for SSRF and auth-bypass classes of bugs is historically short. Do not wait for KEV inclusion to act on a CVSS 8.1 against a security-monitoring platform.

Detection & Response

Detection strategy here focuses on three observable behaviors: SSRF attempts in Malcolm web access logs, direct access to backend component ports that bypass the nginx proxy, and anomalous request volume consistent with decompression/data amplification abuse. Malcolm's nginx and component containers write access logs to the host (typically under the Malcolm installation directory), and those logs should be shipped to your SIEM.

Sigma Rules

---
title: Malcolm SSRF Attempt via Internal Target in Request URI
id: 4c2b8e17-6f3a-4d91-b2e5-9a1c7f5d3e02
status: experimental
description: Detects requests to Malcolm web components containing internal IP addresses, loopback, or cloud metadata endpoints in the request URI or query parameters, consistent with CVE-2026-1073xx SSRF exploitation attempts.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/07
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-query|contains:
      - '169.254.169.254'
      - '127.0.0.1'
      - 'localhost'
      - '0.0.0.0'
      - '[::1]'
      - 'metadata.google.internal'
      - '10.'
      - '172.16.'
      - '192.168.'
  filter_status:
    sc-status:
      - '404'
      - '400'
  condition: selection_path and not filter_status
falsepositives:
  - Malcolm health-check or internal API calls legitimately referencing loopback; tune by source IP to exclude sensor-local traffic
level: high
---
title: Direct Access to Malcolm Backend Component Ports Bypassing Proxy
id: 8f1d5c42-3a7b-4e68-9c14-2b6e0a9f5d77
status: experimental
description: Detects network connections to Malcolm backend services (Arkime viewer, OpenSearch, Logstash API) on their direct container-published ports from non-localhost sources, indicating authentication bypass via alternate path as described in ICSA-26-280-01.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/07
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: firewall
detection:
  selection:
    dst_port:
      - 8005   # Arkime viewer
      - 9200   # OpenSearch
      - 9600   # Logstash API
      - 5044   # Beats input
      - 5601   # OpenSearch Dashboards (if exposed)
  condition: selection
falsepositives:
  - Local container-to-container traffic; restrict to sources outside the Malcolm host and Docker bridge networks
level: high
---
title: Malcolm Console Decompression Bomb / Data Amplification Pattern
id: 2e9a7b31-5c48-4f06-a3d2-7f4c1e8b6a59
status: experimental
description: Detects abnormally large compressed POST bodies or high request rates to Malcolm upload/API endpoints, consistent with the improper handling of highly compressed data weakness (data amplification / DoS) in ICSA-26-280-01.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01
  - https://attack.mitre.org/techniques/T1499/
author: Security Arsenal
date: 2026/10/07
tags:
  - attack.impact
  - attack.t1499
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'POST'
    sc-bytes|gte: 104857600
  condition: selection
falsepositives:
  - Legitimate large PCAP uploads to Arkime; correlate with source identity and reduce threshold for unauthenticated sources
level: medium

KQL — Microsoft Sentinel / Defender

Assuming Malcolm nginx access logs are ingested via Syslog/CEF (recommended: forward container logs with the host syslog daemon), this query hunts for SSRF indicators and alternate-path access to backend services:

// Hunt: SSRF attempts and auth-bypass probing against Malcolm sensors (ICSA-26-280-01)
let lookback = 14d;
let ssrf_indicators = dynamic(["169.254.169.254", "127.0.0.1", "localhost", "[::1]", "metadata.google.internal", "192.168.", "10.0.", "172.16."]);
Syslog
| where TimeGenerated > ago(lookback)
| where Computer has_any ("malcolm") or ProcessName has_any ("nginx", "arkime", "opensearch")
| extend RawMsg = tostring(SyslogMessage)
| where RawMsg has_any (ssrf_indicators)
   and (RawMsg has "GET" or RawMsg has "POST")
| extend SourceIP = extract(@"^(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, RawMsg)
| summarize RequestCount = count(), SampleRequests = take_any(RawMsg, 3)
    by SourceIP, Computer, bin(TimeGenerated, 1h)
| order by RequestCount desc;
// Companion: direct hits on backend component ports (alternate-path bypass)
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DestinationPort in (8005, 9200, 9600, 5044)
| where DeviceAction !in ("deny", "drop", "blocked")
| summarize Hits = count(), DistinctSources = dcount(SourceIP)
    by DestinationIP, DestinationPort, SourceIP
| where Hits > 5
| order by Hits desc

Velociraptor VQL

If you have Velociraptor deployed on the Malcolm sensor host (or jump hosts used to administer it), this artifact hunts the nginx/container access logs on disk for SSRF and probing artifacts:

-- Hunt Malcolm sensor access logs for SSRF and bypass indicators (ICSA-26-280-01)
LET log_files = SELECT FullPath
FROM glob(globs=['/opt/*/nginx/logs/*.log', '/opt/*/logs/nginx/*.log', '/var/log/nginx/access*.log'])

SELECT FullPath,
       Line,
       parse_string_with_regex(string=Line,
         regex='^(?P<src>\d+\.\d+\.\d+\.\d+).*?"(?P<method>[A-Z]+) (?P<uri>[^" ]+)') AS Parsed
FROM foreach(row=log_files,
  query={
    SELECT FullPath, Line
    FROM split_records(filenames=FullPath, regex='\n', columns=['Line'])
    WHERE Line =~ '169\.254\.169\.254|127\.0\.0\.1|localhost|metadata\.google|192\.168\.|172\.16\.|10\.0\.'
       OR Line =~ ':8005|:9200|:9600'
  })
ORDER BY FullPath

Verification and Hardening Script

Run on each Malcolm sensor host to verify version exposure, confirm the fix level, and lock down direct backend port exposure:

#!/usr/bin/env bash
# ICSA-26-280-01 verification & hardening for CISA Malcolm sensors
set -euo pipefail

echo "=== [1] Determine Malcolm version ==="
MALCOLM_DIR="${MALCOLM_DIR:-/opt/Malcolm}"
if [ -d "$MALCOLM_DIR" ]; then
  (cd "$MALCOLM_DIR" && git describe --tags 2>/dev/null || grep -m1 version docker-compose.yml) || true
else
  echo "Malcolm directory not found at $MALCOLM_DIR - set MALCOLM_DIR and rerun."; exit 1
fi

echo "=== [2] If version <= v26.08.0, pull the fixed release and redeploy ==="
# cd "$MALCOLM_DIR" && ./scripts/stop && git pull --tags && git checkout <FIXED_TAG> && ./scripts/start

echo "=== [3] Audit for direct backend port exposure (alternate-path bypass) ==="
for port in 8005 9200 9600 5044 5601; do
  if ss -tlnp 2>/dev/null | grep -q "0.0.0.0:${port} "; then
    echo "[!] EXPOSED: backend service listening on 0.0.0.0:${port} — bind to localhost or block at host firewall"
  fi
done

echo "=== [4] Enforce host firewall: only 443/tcp (and your mgmt ports) inbound ==="
# iptables -A INPUT -p tcp --dport 8005 -s 127.0.0.1 -j ACCEPT
# iptables -A INPUT -p tcp --dport 8005 -j DROP
# iptables -A INPUT -p tcp --dport 9200 -s 127.0.0.1 -j ACCEPT
# iptables -A INPUT -p tcp --dport 9200 -j DROP
# Persist with your distro's mechanism (iptables-save / firewalld / nftables)

echo "=== [5] Grep nginx logs for SSRF indicators from the last 7 days ==="
find "$MALCOLM_DIR" -name 'access*.log' -mtime -7 -print0 2>/dev/null | \
  xargs -0 grep -E '169\.254\.169\.254|127\.0\.0\.1|localhost|metadata\.google' 2>/dev/null | tail -50 || echo "No SSRF indicators found."

echo "=== Done. Review findings before applying firewall changes in production. ==="

Remediation

1. Upgrade immediately. All versions through v26.08.0 are affected. Pull the latest Malcolm release from the official repository (github.com/cisagov/Malcolm) and redeploy the stack (./scripts/stop, git pull --tags, checkout the fixed tag, ./scripts/start). Verify the running version post-upgrade.
2. Eliminate alternate-path exposure. The auth-bypass-via-alternate-channel class only works if backend ports (Arkime 8005, OpenSearch 9200, Logstash 9600, Beats 5044) are reachable beyond localhost. Bind them to the loopback/Docker bridge interface and enforce host-level firewall rules as in the script above. All user-facing access should traverse the nginx proxy on 443 with authentication enforced.
3. Segment the sensor. Malcolm must not be reachable from untrusted networks. Place management interfaces on a dedicated monitoring VLAN, restrict inbound to known analyst subnets via ACLs, and never expose the console to the internet. This directly blunts the SSRF pivot path into OT segments.
4. Enforce MFA and strong auth at the proxy layer, and rotate any credentials or session material on sensors that were network-reachable while vulnerable — assume spoofed sessions may have occurred.
5. Ship sensor logs to your SIEM. nginx access logs, container logs, and host auth logs from Malcolm sensors should be centrally collected (Syslog/CEF to Sentinel or your platform of choice). Deploy the Sigma/KQL detections above and alert on SSRF indicators and backend-port connections.
6. Rate-limit and validate uploads. Until patched, front Malcolm's upload/API endpoints with request-size limits and rate limiting to blunt the data-amplification (decompression bomb) DoS vector that could blind the sensor during an intrusion.
7. Review the official advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01 for per-CVE details, and subscribe to CISA ICS advisories for follow-on updates — including any future KEV additions, which would trigger federal remediation deadlines and should trigger yours.

The deeper lesson: monitoring infrastructure is high-value attack surface. Sensors see everything, trust a lot, and are frequently the least-patched systems in the environment. Treat your visibility layer with the same rigor you demand of the assets it protects.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub