CVE-2026-107334

Malcolm's nginx Lua role-based access control checks the raw, percent-encoded request URI, while nginx selects the location that actually serves the request using the percent-decoded, normalized URI. An authenticated low-privilege user can request a role-restricted path (such as /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, or upload endpoints) with percent-encoding so the Lua gate sees no matching restriction and allows the request, while nginx still routes it to the admin location. That yields unauthorized read and modify access to those admin functions (confidentiality and integrity only; availability is not affected). Organizations running Malcolm with this RBAC layer and any authenticated low-privilege accounts are affected; specific version ranges were not stated in the advisory data. It is not listed in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade Malcolm to a release that percent-decodes and normalizes the URI before the Lua RBAC check, matching nginx's routing. Until then, restrict admin paths (/htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, and upload endpoints) to trusted networks and review access logs for percent-encoded requests to those paths from low-privilege accounts.