EUVD-2026-56972Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered against a web interface (AV:N), trivial traversal craft (AC:L), valid low-priv session required (PR:L); confidentiality high due to unrestricted backend access, integrity low from limited write exposure, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.request_uri, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example /x/../upload/...) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue.
AnalysisAI
Authorization bypass in Malcolm (all versions prior to 26.07.0) allows authenticated low-privilege users to access restricted backend endpoints by exploiting a URI normalization mismatch between Nginx's routing layer and the OpenResty Lua RBAC enforcement layer. By prepending a traversal segment (e.g., /x/../upload/...) to a request path, the Lua role check evaluates the raw unnormalized URI, fails to match any configured rule, and falls open - granting access the policy should deny. No public exploit has been identified at time of analysis, and CISA has released a fix in v26.07.0.
Technical ContextAI
Malcolm is a network traffic analysis tool suite developed by CISA (cisagov), built on a Nginx/OpenResty stack where access control is implemented in Lua scripts that intercept requests before routing. The flaw is rooted in CWE-863 (Incorrect Authorization): the Lua RBAC layer reads ngx.var.request_uri, which contains the raw, client-supplied URI string, while Nginx's internal routing resolves path segments like .. before dispatching to upstream backends. This normalization gap means the two layers are evaluating different effective paths for the same request. The affected CPE is cpe:2.3:a:cisagov:malcolm:*:*:*:*:*:*:*:*, covering all releases prior to 26.07.0. The fail-open design of the Lua RBAC - where an unmatched rule grants rather than denies access - is the critical amplifier that makes this exploitable.
RemediationAI
Upgrade Malcolm to version 26.07.0, which fixes the URI normalization mismatch. The patched release is available at https://github.com/cisagov/Malcolm/releases/tag/v26.07.0. If an immediate upgrade is not possible, a compensating control is to add a Nginx location rewrite or try_files directive that normalizes the URI (resolving .. segments) before the Lua RBAC phase executes - however, this requires careful Nginx configuration testing to avoid breaking legitimate routing and is not a substitute for the vendor patch. Alternatively, restrict network access to the Malcolm web interface to trusted administrator accounts only, removing low-privilege user access entirely until patching is feasible; this eliminates the PR:L attack surface but limits analyst usability. The vendor advisory at https://github.com/cisagov/Malcolm/security/advisories/GHSA-m5fr-rv3h-xg2r should be consulted for any additional guidance.
Authenticated users holding only the granular ROLE_UPLOAD permission in CISA's Malcolm network traffic analysis suite ca
Unbounded archive extraction in Malcolm, CISA's network traffic analysis tool suite, allows a user who can reach the arc
Malcolm, CISA's open-source network traffic analysis platform, ships an nginx-based reverse proxy whose Lua RBAC authori
Path traversal in Malcolm's archive extraction logic allows authenticated low-privilege users to create arbitrary direct
Cross-site request forgery in the CISA Malcolm network traffic analysis platform lets a remote attacker who lures the op
Server-side request forgery (SSRF) in the Malcolm file-upload component allows authenticated low-privilege attackers to
Malcolm's upload-processing pipeline allows an authenticated user with PCAP/log upload rights to exhaust the shared Dock
Authentication bypass in CISA Malcolm's shipped front nginx reverse proxy lets unauthenticated remote attackers reach th
Incorrect authorization in CISA Malcolm allows an authenticated low-privilege user to reach admin-only paths by percent-
Authentication bypass in CISA's Malcolm network traffic analysis platform lets any host with network adjacency to the Ma
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today