CVE-2026-91002
Received Received - Intake

Missing Authentication in Maltrail up to 3.0.1

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulDB

Description
A weakness has been identified in stamparm maltrail up to 3.0.1. This vulnerability affects the function _blacklist of the file core/httpd.py of the component Blacklist Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.1 is able to resolve this issue. This patch is called d95868dff3da4d3bd4f942837a26cb7c73a797ae. It is suggested to upgrade the affected component. The vendor fixed the issue the same day it was reported, in version 3.1, by gating the endpoint on an authenticated session or the new Blacklist_ALLOWLIST option.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91002
EUVD
EUVD-2026-78274

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
stamparm maltrail to 3.0.1 (inc)
stamparm maltrail to 3.1 (exc)
stamparm maltrail 3.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an access control oversight in the Maltrail server's /blacklist endpoint. It allowed unauthenticated users to retrieve source IP addresses of flagged events without restrictions, exposing internal hosts that were marked as suspicious. The issue was fixed in version 3.1 by adding authentication checks and an allowlist system.

Detection Guidance

To detect this vulnerability, check if the /blacklist endpoint is accessible without authentication. Use curl to test unauthenticated access: curl -i http://<maltrail-server>:8338/blacklist. If the endpoint returns data instead of a 404 error, the system is vulnerable.

Impact Analysis

An attacker could exploit this to gather sensitive information about your internal network, including IP addresses of compromised or suspicious hosts. This could aid further attacks by revealing potential targets or weaknesses in your system.

Mitigation Strategies

Upgrade Maltrail to version 3.1 or later immediately. The patch d95868dff3da4d3bd4f942837a26cb7c73a797ae resolves the issue. Alternatively, restrict access to the /blacklist endpoint by configuring BLACKLIST_ALLOWLIST in maltrail.conf to allow only trusted IPs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91002. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart