The vulnerability originates from Arkime's live capture service (arkime‑live) within Malcolm, which runs in host network mode and exposes port 8005 on every network interface. The service treats the X‑Forwarded‑User HTTP header from any IP address as a trusted identity and automatically creates a full‑privilege user when that header is present. Additionally the passwordSecret is hardcoded to the literal string ``Malcolm,'' providing no real authentication mechanism. An attacker who can reach port 8005, for example by being on the same local network segment, can forge an X‑Forwarded‑User header to impersonate any user and bypass authentication, immediately gaining privileged access to the Malcolm platform.

Malcolm by CISA is the affected product. The Arkime live capture component under the Malcolm distribution is the vulnerable element. No specific version numbers are disclosed; however, the official fix is delivered in version v26.08.0.

The CVSS base score of 4.2 indicates a moderate impact. Exploit availability is not listed in CISA KEV and EPSS data is unavailable. The attack vector is local network; no attacker interaction with an existing user account is required. Forging an identity header and connecting to the open port suffices, and because the passwordSecret is hardcoded there is no additional authentication barrier.