CVE-2026-63177: Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.requesturi, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example /x/../upload/...) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Malcolm (Nginx OpenResty Lua RBAC)to a version that resolves this vulnerability.Fixed in 26.07.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63177?
The severity of CVE-2026-63177 is rated high with a CVSS score of 7.1.
How do I fix CVE-2026-63177?
To fix CVE-2026-63177, upgrade Malcolm to version 26.07.0 or later.
What systems are affected by CVE-2026-63177?
CVE-2026-63177 affects Malcolm versions prior to 26.07.0 that utilize Nginx OpenResty Lua RBAC.
What kind of attack does CVE-2026-63177 allow?
CVE-2026-63177 allows an authenticated low-privilege user to bypass authorization controls.
What component is involved in CVE-2026-63177?
CVE-2026-63177 involves the role-based access control mechanisms within the Nginx OpenResty Lua layer.