Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2026-90450: Malcolm allows any logged-in user to reach unlisted functions
CVE-2026-90450 · published 1 month ago
Summary
Malcolm does not block access to features that are not listed in its permission table, so any user who has logged in can use those features regardless of their role. This can let users perform actions they should not be able to, especially when new features are added. Review the permission table and add every handler to it, or change the default to deny access when a handler is missing.
What to do
- Update cisa malcolm to version v26.06.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| cisa | malcolm | < v26.06.0 |
Original advisory text
Incorrect Authorization in Malcolm
The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user regardless of their assigned role, and any newly added handler is fail-open by default until explicitly added to the table.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90450... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-90450 Vendor Advisory
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/... Vendor Advisory
- https://github.com/cisagov/Malcolm Product
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-254-01 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-863Incorrect Authorization
Timeline
Published11 Sep 2026
Updated3 Nov 2026
First seen11 Sep 2026
Track software like this
Free during beta