CVE-2026-90452: Improper certificate validation in Malcolm

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-11 · updated 2026-10-02
Weakness: CWE-295

Description

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the identity provider and issue forged authentication tokens accepted by the deployment.

Affected products

CISA Malcolm: before v26.06.0 — fixed in v26.06.0

How to fix

Upgrade to a fixed version: CISA Malcolm v26.06.0. Check the vendor advisory for mitigations.

References

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-254-01.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-254-01

Get alerted when CVE-2026-90452 or the next vulnerability affects your stack