CISA Patches Its Malcolm Tool for File Upload RCE, RBAC Bypasses
CISA's network traffic analysis tool shipped with an empty file-type allowlist and two independent RBAC bypass vectors. The advisory issuer is this time the subject.
TL;DR
CISA published ICSA-26-230-01 for Malcolm, its own open-source network traffic analysis tool, disclosing six vulnerabilities. The most severe (CVE-2026-55676, CVSS 8.8) allowed arbitrary PHP execution via unrestricted file upload, the file-type allowlist was an empty array by default, so every extension passed. Two separate RBAC bypasses (CVE-2026-63177, CVE-2026-19670) let low-privilege users reach admin endpoints, one via path traversal and one via percent-encoded URIs. Versions 26.06.1 and 26.07.0 fix four flaws; two more await 26.08.0.
CISA published an advisory Tuesday for vulnerabilities in Malcolm, the agency's own open-source network traffic analysis tool. That's unusual on its face: the organization that issues ICS advisories is this time the subject of one. But what makes the advisory worth reading isn't the role reversal. It's what the vulnerabilities say about the gap between the security an agency prescribes for others and the security it ships itself.
The worst of the six is CVE-2026-55676 (CVSS 8.8), an unrestricted file upload in Malcolm's FilePond PHP backend. The allow-list meant to restrict accepted file types was, by default, an empty array. Every extension passed. The filename sanitizer kept .php intact. Committed files landed in a directory served by nginx and php-fpm, and any authenticated user with the upload-only role, a role designed for submitting capture files and nothing more, could execute arbitrary PHP as www-data. Version 26.06.1 fixes it by implementing an actual allow-list.
The RBAC implementation had two independent bypass paths. CVE-2026-63177 let an authenticated low-privilege user prepend a traversal segment so that nginx routed to a restricted backend while the Lua RBAC check, which evaluated the raw unnormalized URI, failed to match any rule and fell open. CVE-2026-19670 exploited the same mismatch differently: the Lua layer matched against the raw percent-encoded URI, but nginx routes using the decoded path. Percent-encode /admin in the request and the RBAC gate sees gibberish where it expects a path, no restriction matches, so the request goes through. Two bugs, same root cause: the RBAC layer and the router were reading different strings, but exploited through different mechanisms.
The remaining flaws cover resource exhaustion (CVE-2026-63133), path traversal during extraction (CVE-2026-63134), and a gzip-bomb vector in single-stream compressed uploads (CVE-2026-19671). The fixes are staggered: 26.06.1 handles the file upload RCE, 26.07.0 handles the extraction and first RBAC bypass, and 26.08.0 (not yet released at the time of the advisory) will close the percent-encoding bypass and the decompression bomb. Operators running Malcolm should move to 26.07.0 immediately and watch for 26.08.0.
Published ·Updated ·Deep Fathom