CISA Malcolm
CISA patched high-severity Malcolm flaws through version 26.08.0, including authentication bypass and SSRF.
66
Vulnerability3 · 1 read
CVE-2026-107333
RBAC path-normalization bypass in Malcolm nginx proxy
- CVSS 3.1
- 8.1 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Malcolm’s nginx reverse proxy has an incorrect-authorization flaw caused by inconsistent URL path normalization between its Lua role-based access control checks and nginx’s own routing. An authenticated user can send a specially formatted path so the RBAC layer allows a request that nginx then delivers to a restricted endpoint. Successful bypass can reach administrative or role-gated functions, including file upload, the PHP server, htadmin, and authentication management, with high impact on confidentiality and integrity and no direct availability impact (CVSS 3.1 8.1). Deployments of Malcolm that rely on this RBAC layer for those paths are affected; the advisory does not name version ranges. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Apply the Malcolm project fix as soon as a patched release is published, and until then keep the web interface off untrusted networks. Limit accounts to least privilege and review access logs for unusual paths to file upload, PHP, htadmin, and authentication-management endpoints.
| Product | Affected |
|---|---|
| Malcolm project (Idaho National Laboratory / ICS-CERT coordinated) Malcolm (nginx-based reverse proxy / RBAC layer) | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach administrative or role gated endpoints they should not have access to. This affects all restricted paths protected by the RBAC authorization layer, including file upload, PHP server, htadmin, and authentication management interfaces.
- Weakness
- CWE-863
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N