A hardcoded secret in CISA Malcolm allows unauthenticated attackers to forge authentication cookies, potentially leading to unauthorized access to packet analysis components.

This vulnerability involves the use of default credentials (CWE-1392) where a static, publicly known secret key is used to sign authentication cookies. An unauthenticated attacker can leverage this known default to bypass authentication mechanisms entirely.

The ability to forge authentication cookies poses a significant risk to the integrity and confidentiality of packet analysis data. Successful exploitation permits an attacker to impersonate legitimate users, potentially accessing sensitive network traffic metadata or manipulating analysis results, which may result in a total compromise of the monitoring platform. The CVSS score of 8.2 classifies this as a high severity issue, reflecting the ease of exploitation once the default configuration is identified.

Immediate Action: Update the Malcolm deployment to version v26.06.0 or later, which ensures the environment configuration enforces secure secret generation.

Proactive Monitoring: Review authentication logs for anomalous login patterns or multiple successful sessions originating from unexpected sources that do not correspond to known administrative access.

Compensating Controls: Ensure that the Malcolm instance is not exposed to the public internet and restrict access to the management interface to trusted internal network segments via firewall rules.

Public Exploit Available: Unknown

This vulnerability represents a critical misconfiguration risk that can be easily exploited if the default deployment steps are ignored. Administrators must prioritize updating to version v26.06.0 immediately to remediate the hardcoded secret. If an update is not immediately feasible, verify that the configuration secret has been manually regenerated and is not using the default value provided in the example file.