CVE-2026-63177
Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized `ngx.var.request_uri`, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example `/x/../upload/...`) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue.
| CWE | CWE-863 |
| Vendor | cisagov |
| Product | malcolm |
| Published | Aug 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for cisagov malcolm
Be the first to know when new high vulnerabilities affecting cisagov malcolm are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
cisagov / Malcolm
< 26.07.0