CVE-2026-63177 PUBLISHED

Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC

Assigner: GitHub_M
Reserved: 15.07.2026 Published: 11.08.2026 Updated: 11.08.2026

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.request_uri, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example /x/../upload/...) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS Score: 7.1

Product Status

Vendor cisagov
Product Malcolm
Versions
  • Version < 26.07.0 is affected

References

Problem Types

  • CWE-863: Incorrect Authorization CWE