---
id: CVE-2026-90451
title: >-
  An example environment-configuration file ships with a fixed, publicly-known
  secret value used to sign authentication cookies for a bundled packet-analysis
  component
summary: >-
  An example environment-configuration file ships with a fixed, publicly-known
  secret value used to sign authentication cookies for a bundled packet-analysis
  component. A deployment that copies this example file into active
  configuration w…
severity: high
cvss: 8.2
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-1392
vendor: CISA
product: Malcolm
affected:
  - Malcolm < v26.06.0
published: '2026-09-11'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T19:40:31.053'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90451'
references:
  - url: >-
      https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-254-01.json
    label: ics-cert@hq.dhs.gov
tags:
  - nvd
  - cve.org
epss: 0.00328
epssPercentile: 0.26175
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T12:51:32.056010Z'
cvssSource: cna
ingestedAt: '2026-09-14T15:23:07.429Z'
---

## Overview

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value will use the known default, allowing an attacker aware of the default to forge valid authentication cookies for that component.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.