CVE-2026-19670: Incorrect Authorization in CISA Malcolm
Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects which location block actually serves the request using the percent-decoded, normalized URI. Because the RBAC check never percent-decodes its input, an authenticated low-privilege user can request an admin-only path using percent-encoding (e.g. /%68tadmin.php) and have nginx route it to the restricted location while the Lua RBAC gate evaluating the un-decoded raw string finds no matching restriction and grants access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Malcolmto a version that resolves this vulnerability.Fixed in 26.08.0 - Compensating control
Ensure nginx routing/location matching and the Malcolm nginx Lua RBAC authorization decision use the same percent-decoding/normalization behavior for the request URI so percent-encoded admin-only paths cannot bypass the RBAC pattern-matching.
Event History
Frequently Asked Questions
Who can exploit this issue?
Authenticated users with low privileges are realistically exposed to this authorization bypass when they can send requests to Malcolm endpoints protected by the nginx Lua RBAC layer. The affected paths include administrative, authentication, NetBox, upload, and Arkime Elasticsearch administration endpoints.
What is required to bypass the access control?
An attacker needs valid authentication as a low-privilege user; no user interaction is required. They must request a restricted path with percent-encoded characters so the Lua check evaluates the raw encoded URI while nginx routes the decoded URI to the restricted location.
How can I look for exploitation?
Review requests to role-restricted endpoints for percent-encoded path characters, particularly requests whose decoded path maps to paths such as /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, or upload endpoints. A mismatch between the encoded request URI evaluated by RBAC and the decoded path served by nginx indicates attempted or potentially successful bypass activity.