CVE-2026-63177

HIGH 7.1

Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC

CVSS Score

7.1

EPSS Score

0.3%

EPSS Percentile

21th

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized `ngx.var.request_uri`, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example `/x/../upload/...`) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue.

CWE	CWE-863
Vendor	cisagov
Product	malcolm
Published	Aug 11, 2026
Last Updated	Oct 2, 2026

Stay Ahead of the Next One

Get instant alerts for cisagov malcolm

Be the first to know when new high vulnerabilities affecting cisagov malcolm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Affected Versions

cisagov / Malcolm

< 26.07.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/cisagov/Malcolm/security/advisories/GHSA-m5fr-rv3h-xg2r github.com: https://github.com/cisagov/Malcolm/releases/tag/v26.07.0 cisa.gov: https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01 github.com: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-230-01.json

Credits

pavanchow reported this vulnerability to CISA.