---
id: CVE-2026-90451
title: >-
  An example environment-configuration file ships with a fixed, publicly-known
  secret value used to sign authentication cookies for a bundled packet-analysis
  component
summary: >-
  An example environment-configuration file ships with a fixed, publicly-known
  secret value used to sign authentication cookies for a bundled packet-analysis
  component. A deployment that copies this example file into active
  configuration w…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-1392
vendor: CISA
product: Malcolm
affected:
  - Malcolm < v26.06.0
published: '2026-09-11'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T22:16:55.740'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90451'
references:
  - url: >-
      https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-254-01.json
    label: ics-cert@hq.dhs.gov
  - url: 'https://www.cisa.gov/news-events/ics-advisories/icsa-26-254-01'
    label: ics-cert@hq.dhs.gov
tags:
  - nvd
  - cve.org
  - score-dispute
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T12:51:32.056010Z'
epss: 0.00251
epssPercentile: 0.16433
scores:
  nvd: 5.9
  cna: 8.2
ingestedAt: '2026-09-14T15:23:07.429Z'
---

## Overview

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value will use the known default, allowing an attacker aware of the default to forge valid authentication cookies for that component.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.