Malcolm's front nginx reverse proxy contains a rule that incorrectly handles case-sensitive rewrites for a dashboard shortcut. A request with a non-lowercase path segment matches the location but bypasses the rewrite that would normally redirect the request to an authenticated endpoint. The proxy forwards the request to Arkime without applying its per-location authentication file and passes through a client-supplied X-Forwarded-User header, which Arkime trusts as the authenticated username. Consequently, unauthenticated callers can reach Arkime and present any identity they choose, effectively bypassing authentication and enabling identity spoofing. This flaw exists in the Malcolm application as shipped with the default nginx configuration. It affects installations that use the Dashboards → Arkime shortcut location and a proxy_pass to Arkime. CISA lists a fix in version v26.08.0; installations prior to that release are vulnerable. The CVSS score of 6.5 indicates a moderate severity, and the EPSS score is not available, so the exact likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by sending a crafted HTTP request to the vulnerable location from any network, without requiring credentials. By supplying a forged X-Forwarded-User header, an attacker can impersonate any user in Arkime, compromising confidentiality and integrity.

The vulnerability exists in Malcolm deployments using the default nginx configuration, particularly those that enable the Dashboards → Arkime shortcut. Versions before 26.08.0 are affected; all later releases include the fix.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available, so the exact likelihood of exploitation cannot be quantified. The situation is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending a crafted HTTP request to the vulnerable location from any network without credentials. By supplying a forged X-Forwarded-User header, an attacker can impersonate any user in Arkime, compromising confidentiality and integrity.