CVE-2026-19670 in Malcolm
Summary
by MITRE • 08/18/2026
Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects which location block actually serves the request using the percent-decoded, normalized URI. Because the RBAC check never percent-decodes its input, an authenticated low-privilege user can request an admin-only path using percent-encoding (e.g. /%68tadmin.php) and have nginx route it to the restricted location while the Lua RBAC gate evaluating the un-decoded raw string finds no matching restriction and grants access.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability described constitutes a critical authorization bypass within an Nginx-based web infrastructure that utilizes a custom Lua layer for role-based access control. The core technical flaw stems from a fundamental inconsistency in how Uniform Resource Identifiers are processed at different stages of the request handling lifecycle. Specifically, the RBAC enforcement mechanism relies on pattern-matching against the raw, percent-encoded URI string as it arrives from the client. In contrast, Nginx’s internal routing logic normalizes and decodes this URI before determining which location block should handle the request. This discrepancy creates a security gap where an attacker can exploit the difference between the encoded representation seen by the access control layer and the decoded path interpreted by the web server.
In practice, this flaw allows authenticated users with low privileges to bypass administrative restrictions entirely. For instance, while a standard user might be denied access to sensitive endpoints such as /htadmin or /arkime/api/esadmin, they can instead request these paths using percent-encoded variations like /%68tadmin.php. The Lua RBAC module evaluates the raw string and fails to find it in its list of restricted patterns because it does not perform URL decoding. Consequently, the access control check passes. However, Nginx subsequently decodes the URI during routing, recognizing that %68 corresponds to 'h', thereby directing the request to the actual admin location block intended for high-privilege users only. This results in unauthorized execution of administrative functions and potential exposure of sensitive data or system configuration.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically illustrating how inconsistent validation logic across different processing layers can lead to privilege escalation. It also maps closely to the MITRE ATT&CK technique T1078 Valid Accounts, as it leverages legitimate but low-level credentials to gain unauthorized access to restricted resources through input manipulation rather than credential theft or brute force. The attack vector is classified under Input Validation weaknesses because the system fails to normalize inputs before performing security-critical decisions.
The operational impact of this vulnerability is severe, particularly in environments where administrative interfaces are exposed to untrusted networks or where multi-tenant architectures rely on strict isolation between user roles. An attacker could potentially modify configurations, exfiltrate data, install malicious plugins, or disrupt services depending on the capabilities granted by the compromised admin endpoints such as NetBox or Arkime administration panels. This undermines the integrity and confidentiality guarantees provided by the application’s security model.
To mitigate this issue, developers must ensure that all access control checks operate on normalized input rather than raw request data. The Lua RBAC layer should explicitly decode percent-encoded URIs before performing pattern matching against restricted paths. Alternatively, Nginx configuration can be adjusted to enforce consistent URI handling by using the $uri variable which contains the decoded path, ensuring that both routing and authorization logic evaluate the same canonical representation of the resource. Regular security audits focusing on input normalization across all middleware layers are essential to prevent similar bypasses in complex web architectures.