CVE-2026-90446

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90446
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90446.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90446
Published
2026-09-11T21:48:29Z
Modified
2026-09-13T03:47:20Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
[none]
Details

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend path, causing the application's own elevated service credentials to be used against unintended internal endpoints. This could allow an attacker to enumerate or read internal configuration and administrative data from the backend data store that would otherwise be restricted.

Database specific 
{
    "cna_assigner": "icscert",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90446.json"
}
References

Affected packages

Git / github.com/cisagov/malcolm

Affected ranges

Type
GIT
Repo
https://github.com/cisagov/malcolm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ca3d1febde94fef45d82151772a40f5f961a35c9
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "v26.06.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v1.3.1
v1.4.0
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.7.0
v1.7.1
v1.7.1a
v1.7.2
v1.8.0
v1.8.1
v2.*
v2.0.0
v2.0.0-pre1
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.1.0
v2.1.1
v2.2.0
v2.2.1
v2.3.0
v2.4.0
v2.4.0.1
v2.4.1
v2.4.2
v2.5.0
v2.6.0
v2.6.1
v26.*
v26.05.2
v3.*
v3.0.0
v3.0.1
v5.*
v5.2.1
v5.2.2
v5.2.3
v5.2.4
v6.*
v6.4.0
v6.4.1
v6.4.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90446.json"