CVE-2026-107334 in Malcolm
Summary
by MITRE • 10/08/2026
Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects which location block actually serves the request using the percent-decoded, normalized URI. Because the RBAC check never percent-decodes its input, an authenticated low-privilege user can request an admin-only path using percent-encoding (e.g. /%68tadmin.php) and have nginx route it to the restricted location while the Lua RBAC gate evaluating the un-decoded raw string finds no matching restriction and grants access.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability described constitutes a critical authorization bypass within an Nginx-based web infrastructure that utilizes a custom Lua layer for role-based access control. This flaw arises from a fundamental inconsistency in how request URIs are processed by the underlying web server versus the application-level security middleware. Specifically, while Nginx normalizes and percent-decodes the incoming URI to determine which location block should handle the request, the Lua RBAC module evaluates permissions against the raw, unmodified, percent-encoded string provided by the client. This discrepancy creates a logic gap that allows authenticated users with low privileges to access administrative endpoints intended for higher-privilege roles.
In standard HTTP operations, special characters in URIs are often represented using percent-encoding, where each character is replaced by a percent sign followed by two hexadecimal digits. For instance, the lowercase letter h is encoded as %68. When Nginx receives a request for /%68tadmin.php, it performs URI normalization and decoding before routing the traffic to the appropriate backend or location block defined in its configuration files. Consequently, if there is a location block configured to serve requests matching /htadmin.php with restricted access controls at the server level, Nginx will correctly route this request to that protected area. However, because the Lua RBAC module inspects only the raw URI string containing %68 instead of the decoded ht, it fails to recognize the path as a restricted resource. The security check effectively looks for /htadmin.php in its access control list but finds nothing matching /%68tadmin.php, thereby erroneously granting access based on insufficient pattern matching logic.
The operational impact of this vulnerability is severe, particularly when applied to sensitive administrative interfaces such as NetBox, Arkime Elasticsearch administration endpoints, or general authentication and upload mechanisms. An attacker who has obtained valid credentials for a low-privilege account can exploit this encoding mismatch to bypass role-based restrictions entirely. This allows the unauthorized user to execute administrative functions, modify system configurations, access sensitive data stored within these applications, or potentially escalate privileges further depending on the capabilities exposed by those specific endpoints. Since the authentication step is passed successfully and only authorization is flawed, traditional intrusion detection systems that monitor for failed login attempts may not flag this activity as malicious, making it a stealthy vector for compromise.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting failures in enforcing security policies due to inconsistent input handling or logic errors in authorization checks. It also maps closely to MITRE ATT&CK technique T1078 Valid Accounts, where an adversary uses legitimate credentials to access resources they should not have permission to view or modify. The root cause is a classic case of normalization inconsistency, similar to issues seen in various web application firewalls and routing engines that fail to align their security checks with the actual execution path of the request.
Mitigation requires immediate remediation within the Lua RBAC module logic. Developers must ensure that any URI used for authorization decisions undergoes the same decoding and normalization process as the one performed by Nginx before being compared against access control rules. This involves implementing a robust percent-decoding function in the Lua script to transform raw URIs into their canonical forms prior to pattern matching. Additionally, input validation should be standardized across both the web server configuration and the application layer to ensure consistency. Testing procedures must include fuzzing with various encoding techniques, including double-encoding and Unicode variations, to verify that no bypass paths remain open. Long-term architectural improvements might involve centralizing URI normalization logic or using a unified security module that operates on normalized data throughout the request lifecycle.