Malcolm's arkime-live service runs with network_mode: host, binding port 8005 on all interfaces. Arkime is configured to trust the X-Forwarded-User header from any source address (userAuthIps set to ::,0.0.0.0/0) and to auto-create users with full access on first sight. A network-adjacent attacker can therefore impersonate any user, including administrators, by supplying an arbitrary X-Forwarded-User value, without presenting any credential.
Authentication bypass via the Arkime live-capture service trusting X-Forwarded-User from any network.
cve.org record · GitHub Security Advisory GHSA-86h3-7rf8-8j34