EUVD-2026-56972Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Network-delivered against a web interface (AV:N), trivial traversal craft (AC:L), valid low-priv session required (PR:L); confidentiality high due to unrestricted backend access, integrity low from limited write exposure, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.request_uri, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example /x/../upload/...) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue.
AnalysisAI
Authorization bypass in Malcolm (all versions prior to 26.07.0) allows authenticated low-privilege users to access restricted backend endpoints by exploiting a URI normalization mismatch between Nginx's routing layer and the OpenResty Lua RBAC enforcement layer. By prepending a traversal segment (e.g., /x/../upload/...) to a request path, the Lua role check evaluates the raw unnormalized URI, fails to match any configured rule, and falls open - granting access the policy should deny. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session with at least low-privilege access to the Malcolm web interface (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, score 7.1) accurately characterizes this as a network-accessible, low-complexity authorization bypass requiring only a valid low-privilege account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated analyst account with standard (low-privilege) read-only access to Malcolm sends an HTTP request crafted with a path traversal prefix - for example, `GET /x/../upload/sensitive-config HTTP/1.1`. Nginx normalizes this to `/upload/sensitive-config` and routes it to the restricted upload backend, while the Lua RBAC check evaluates the raw path `/x/../upload/sensitive-config`, fails to match any defined access rule, and defaults to allowing the request. … |
| Remediation | Upgrade Malcolm to version 26.07.0, which fixes the URI normalization mismatch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Malcolm deployments, document current version numbers, and identify which low-privilege user accounts exist in each environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Malcolm (cisagov) prior to version 26.06.1 allows an authenticated user holding the ROLE_UPLOAD
Resource exhaustion in Malcolm's archive extraction component allows authenticated network users to deny service to the
Path traversal in Malcolm's archive extraction logic allows authenticated low-privilege users to create arbitrary direct
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today