CISA Malcolm Update Addresses Fifteen Security Vulnerabilities
Tech GuruQuick Answer
CISA ICSA-26-254-01 lists Malcolm before v26.06.0 as affected and directs users to the September 2026 release or later. Follow the current supported release mapping rather than guessing that a calendar label is a version number. Updating alone does not enable the added identity-provider certificate check: affected deployments must explicitly configure KEYCLOAK_SSL_VERIFY.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory CISA Malcolm before v26.06.0, match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Last verified: 2026-10-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | CISA Malcolm before v26.06.0 |
|---|---|
| Advisory | ICSA-26-254-01 |
| CVEs | CVE-2026-90443, CVE-2026-90444, CVE-2026-90445, CVE-2026-90446, CVE-2026-90447, CVE-2026-90448, CVE-2026-90449, CVE-2026-90450, CVE-2026-90451, CVE-2026-90452, CVE-2026-90453, CVE-2026-90454, CVE-2026-90455, CVE-2026-90456, CVE-2026-90457 |
| Authoritative release date | 2026-10-01 (CISA public advisory date; CSAF current release 2026-10-01 06:00 UTC) |
| Authority revision date | Initial public publication; no later material revision stated when verified |
| Affected versions | CISA Malcolm releases before v26.06.0. |
| Fixed version | CISA Malcolm September 2026 release or later, with KEYCLOAK_SSL_VERIFY explicitly enabled where certificate validation is required |
| CVSS base score | 3.5–8.8 (official CVSS v3.1 range) |
| CVSS severity | Low to High |
| Exploitation status | CISA reports no known public exploitation specifically targeting these vulnerabilities; no exploitation claim is inferred. |
What Changed
The fifteen issues include authenticated upload/command and archive-path handling, authorization paths that can bypass intended read-only roles, and known secrets in example configuration copied without setup. The certificate issue concerns proxy-to-identity-provider verification. One reverted dependency is described as using only a fixed trusted URL, so its practical exposure is narrower than a blanket arbitrary-input claim.
What To Validate Now
- Inventory. Locate CISA Malcolm before v26.06.0 deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Match the exact product and affected-version statement in ICSA-26-254-01. Do not generalize the finding to another product, service, or release.
- Remediate. Update using Malcolm's supported deployment procedure while preserving site configuration and retained data. Explicitly enable KEYCLOAK_SSL_VERIFY and configure the required trust chain. Review copied example secrets and use the supported setup/rotation process where defaults persist. Do not overwrite the entire environment file or disable certificate checks to suppress connection failures.
- Validate. Record the deployed release/images and effective certificate-verification setting. Check ordinary login, approved low-privilege/read-only access and ingestion of a benign sample capture or log. Confirm ingestion reaches the expected data store and that the identity provider has a trusted certificate. Keep real packet captures and credentials out of public support output.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Back up configuration and retained evidence before the supported upgrade. Keep sensors and ingestion dependencies in scope so an apparently healthy web interface does not conceal a collection gap. This notice has not tested Malcolm, role enforcement or certificate rejection.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
