{"id":"CVE-2026-107336","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-107336","generatedAt":"2026-10-28T02:25:12.493Z","title":"Malcolm's front nginx reverse proxy defines a \"Dashboards → Arkime shortcut\" location using a case-insensitive regex matcher but a case-sensitive rewrite.","description":"Malcolm's front nginx reverse proxy defines a \"Dashboards → Arkime shortcut\" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (the matcher fires) but evades the rewrite (no redirect is issued), so nginx falls through to the location's proxy_pass to the Arkime backend. That location is the one proxied location in the shipped config that does not include the per-location authentication file, so the request reaches Arkime unauthenticated. The same location also forwards a client-supplied X-Forwarded-User header un-overwritten, and Arkime is configured to trust X-Forwarded-User as the authenticated username — so an unauthenticated network caller can reach the Arkime backend while supplying a forged, auto-provisioned identity.","published":"2026-10-08T18:17:20.000Z","lastModified":"2026-10-08T21:03:44.000Z","status":"Awaiting Analysis","sourceIdentifier":"ics-cert@hq.dhs.gov","cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"cwe":["CWE-290","CWE-441","CWE-863"],"affected":[],"epss":{"score":0.00241,"percentile":0.1513,"date":"2026-10-26","history":[{"date":"2026-10-09","score":0.00241,"percentile":0.14042}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-08T18:17:20.000Z","detail":{"score":"6.5","severity":"MEDIUM","publishedAt":"2026-10-08T18:17:20.177Z"},"summary":"New CVE, medium severity (CVSS 6.5)."}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://github.com/cisagov/Malcolm/security/advisories/GHSA-7j32-cf27-cp6h","source":"ics-cert@hq.dhs.gov"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-107336","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}