CVE-2026-63177 in Malcolm
Summary
by MITRE • 08/11/2026
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized `ngx.var.request_uri`, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example `/x/../upload/...`) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability exists within Malcolm's network traffic analysis tool suite where the role-based access control mechanism operates at the Nginx OpenResty Lua layer. The fundamental flaw stems from a mismatch between how the Lua layer processes request paths and how Nginx itself handles path routing. Specifically, the system evaluates the raw `ngx.var.request_uri` variable which contains the unnormalized request path including traversal sequences like /x/../, while Nginx internally normalizes these paths for actual routing purposes. This discrepancy creates a security gap where authenticated users with low privileges can exploit path traversal techniques by prepending malicious segments to their requests.
The technical implementation of this vulnerability occurs through the OpenResty Lua layer's RBAC enforcement which fails to normalize incoming URI paths before performing access control checks. When an attacker crafts a request containing traversal sequences such as /x/../upload/..., the Nginx server normalizes this path internally and routes it to the appropriate backend endpoint for restricted resources like upload functionality. However, the Lua-based access control logic continues to evaluate against the original unnormalized path string, causing it to fail matching against any defined access rules and consequently falling open to grant unauthorized access.
The operational impact of this vulnerability is significant as it allows low-privilege authenticated users to bypass intended access restrictions and gain unauthorized access to restricted backend functionality. This effectively creates a privilege escalation vector within the Malcolm tool suite where attackers can potentially access sensitive upload endpoints, administrative functions, or other protected resources that should only be accessible to higher-privileged users. The vulnerability essentially undermines the entire RBAC framework by exploiting a path normalization inconsistency between different layers of the web application stack.
This issue aligns with CWE-22 Path Traversal and CWE-352 Cross-Site Request Forgery patterns, representing a classic path normalization mismatch that enables unauthorized access through carefully crafted URI sequences. From an ATT&CK perspective, this vulnerability maps to T1078 Valid Accounts and T1566 Phishing, as it allows privilege escalation through legitimate authenticated sessions while potentially serving as an initial access vector for further exploitation within the network monitoring environment. The fix implemented in version 26.07.0 resolves this by ensuring that path normalization is consistently applied across both the Nginx routing layer and the OpenResty Lua access control checks, eliminating the gap that allowed attackers to bypass security controls through crafted traversal sequences.
Organizations using Malcolm should immediately upgrade to version 26.07.0 or later to remediate this vulnerability. Additionally, implementing proper input validation and path normalization checks at multiple layers of the application stack provides defense in depth. Regular security testing should include verification of path handling consistency across different components, particularly when using reverse proxy configurations with complex routing rules. System administrators should also monitor access logs for unusual patterns that might indicate attempted exploitation of similar path traversal vulnerabilities in other applications within their network infrastructure.