CISA Malcolm

CISA Malcolm, a widely used open-source network traffic analysis tool deployed across critical infrastructure sectors such as energy and water, was found to contain six significant vulnerabilities including authentication bypass, SSRF, and CSRF flaws. These weaknesses could allow unauthenticated attackers to gain unauthorized access, exfiltrate sensitive data, or cause denial of service — posing serious risks to operational technology (OT) environments. The presence of authentication bypass vulnerabilities is particularly dangerous in critical infrastructure contexts, where disruption can have real-world physical consequences. This incident highlights the importance of proactively tracking vulnerabilities in security tooling itself, not just the systems it monitors. Even trusted, purpose-built security tools must be subject to rigorous vulnerability management and network hardening practices.