CVE-2026-90451

Use of Default Credentials in Malcolm

State: Published
Severity: 8.2 High
Published: Sep 11, 2026
Updated: Oct 2, 2026
Reserved: Sep 11, 2026

Description

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value will use the known default, allowing an attacker aware of the default to forge valid authentication cookies for that component.

Scores

CVSS	Score	Vector	Source
4.0	8.2 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N	icscert
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N	icscert

Weaknesses

CWE-1392 Use of default credentials

Affected Products

Product	Versions
MalcolmCISA	before v26.06.0Affected v26.06.0Not affected

References

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-254-01.jsongovernment-resourcevendor-advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-26-254-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.