TL;DR

What: Malcolm — the free network-traffic-analysis suite built by CISA and Idaho National Laboratory — shipped an nginx reverse-proxy config where one route's matcher was case-insensitive but its redirect was case-sensitive . Requesting that route in any non-lowercase casing ( /IDDASH2ARK/… ) slipped past the redirect and fell through to an unauthenticated proxy_pass , in one of two proxied locations that never got the auth include.

Impact: an unauthenticated network caller reaches the Arkime full-packet-capture backend, and because that same location forwards a client-supplied X-Forwarded-User header un-overwritten — the exact header Arkime is configured to trust as the logged-in user — the caller arrives with a forged, auto-provisioned identity. Rated Moderate 6.5 ( CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N ).

Fixed in v26.08.0 , advisory GHSA-7j32-cf27-cp6h , credited to me as reporter.…