Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-90446

Quick assessment

Affected
CISA Malcolm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

应用程序编程接口（API）端点接收一个由用户提供的值，并将其直接插入到发往底层搜索和分析数据存储的后端请求路径中，且未对其内容做任何限制。这使得经过身份验证的攻击者可以替换为任意的后端路径，从而让应用程序自身的高权限服务凭证被用于访问非预期的内部端点。这可能导致攻击者枚举或读取本应受限的后端数据存储中的内部配置和管理数据。

CVSS 5.3 · Medium EPSS 0.21% · P11

Affected Version Matrix 2

VendorProduct Version RangeStatus
CISA Malcolm < v26.06.0 affected
v26.06.0 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90446

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend path, causing the application's own elevated service credentials to be used against unintended internal endpoints. This could allow an attacker to enumerate or read internal configuration and administrative data from the backend data store that would otherwise be restricted.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
CISA Malcolm 0 ~ v26.06.0 -

II. Public POCs for CVE-2026-90446

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90446

请登录查看更多情报信息。

Same Patch Batch · CISA · 2026-09-11 · 15 CVEs total

CVE-2026-90456 9.2 CRITICAL 库存管理组件示例配置硬编码管理密码
CVE-2026-90444 8.7 HIGH 文件传输接口命令注入导致认证用户权限提升
CVE-2026-90451 8.2 HIGH 数据包分析组件硬编码密钥致认证Cookie可伪造
CVE-2026-90448 7.1 HIGH 只读模式未限制写操作，致记录可被覆盖
CVE-2026-90447 7.1 HIGH Apache Shiro 5.3.5 认证路由逻辑漏洞
CVE-2026-90445 7.1 HIGH 文件上传解压时路径遍历导致任意文件写入
CVE-2026-90457 6.9 MEDIUM 本地用户可读的管理密码弱哈希文件权限漏洞
CVE-2026-90449 6.9 MEDIUM 某网关特定认证模式下管理接口认证绕过
CVE-2026-90455 6.3 MEDIUM HTTP客户端库回滚致漏洞回归
CVE-2026-90452 6.0 MEDIUM Nginx反向代理至身份提供者证书验证缺失
CVE-2026-90454 5.3 MEDIUM Zeroc-ice读模式漏配允许修改会话标签
CVE-2026-90450 5.3 MEDIUM 应用角色授权查找默认放行：未注册处理器可被任意用户访问
CVE-2026-90443 5.3 MEDIUM 软件未认证反射型XSS漏洞
CVE-2026-90453 5.1 MEDIUM 文件上传Referer未校验致任意重定向

IV. Related Vulnerabilities

Same product: Malcolm
Same vendor: CISA
Same weakness: CWE-918

V. Comments for CVE-2026-90446

No comments yet

Leave a comment