CVE-2026-107361

MediumCVSS 4.2/10Last modified Oct 8, 2026

Description

The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-creates users with full access. The passwordSecret is hardcoded to the public value "Malcolm". A network-adjacent attacker bypasses nginx entirely by connecting directly to port 8005 with a forged identity header.

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-288

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 8, 2026
Last modified: Oct 8, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1073627.1Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all u CVE-2026-1073636.1In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authent CVE-2026-1073668.3IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bu CVE-2026-1073696.1The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, CVE-2026-107377.5The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_fi CVE-2026-1073705.3When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication tra CVE-2026-1073715.4When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting I CVE-2026-1073739.1ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. CVE-2026-1073758.8JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0 CVE-2026-1073768.2webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive desce CVE-2026-1073777.5datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf sch CVE-2026-1073788.7CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path contain