Executive brief
Maltrail is an open-source malicious traffic detection system used to monitor network activity for suspicious behavior. A weakness in the blacklist endpoint allows unauthenticated attackers to remotely access sensitive internal IP address information that should only be visible to authenticated administrators, potentially exposing network topology and flagged hosts to unauthorized parties.
Technical details
The vulnerability is an authentication bypass in the _blacklist function within core/httpd.py affecting the Blacklist Endpoint. Unauthenticated remote attackers can send GET requests to the /blacklist endpoint and receive sensitive information about flagged internal source IP addresses without credentials. The attack requires only network reachability to the Maltrail HTTP interface; no user interaction or prior authentication is needed. An attacker can enumerate blacklist configuration and leak internal IP addresses intended for authenticated users only. The vendor patched this in version 3.1 by gating the endpoint on authenticated sessions or introducing the BLACKLIST_ALLOWLIST configuration option.
Affected products
- stamparm Maltrail up to 3.0.1
Timeline
- 2026-08-15: disclosed
- 2026-09-15: advisory
- 2026: patched: Version 3.1 released same day as initial report with patch d95868dff3da4d3bd4f942837a26cb7c73a797ae