CVE-2026-19670: Malcolm nginx Authentication Bypass Flaw

CVE-2026-19670 Overview

CVE-2026-19670 is an authorization bypass vulnerability in Malcolm, the network traffic analysis suite maintained by CISA. The flaw resides in the nginx Lua role-based access control (RBAC) layer, which gates authenticated users from role-restricted paths such as /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, and upload endpoints. The RBAC check evaluates the raw, percent-encoded request URI, while nginx routes the request using the percent-decoded, normalized URI. An authenticated low-privilege user can request an admin-only path with percent-encoding and reach the restricted location. The weakness is classified as incorrect authorization [CWE-863].

Critical Impact
Authenticated low-privilege users can access administrative endpoints in Malcolm by encoding characters in the request path, bypassing the Lua RBAC gate.

Affected Products

Malcolm network traffic analysis suite (nginx Lua RBAC layer)
Deployments exposing role-restricted endpoints including /htadmin, /auth, /admin_login, /arkime/api/esadmin
NetBox and upload endpoints proxied through Malcolm's nginx configuration

Discovery Timeline

2026-08-18 - CVE-2026-19670 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-19670

Vulnerability Analysis

Malcolm's front-end nginx configuration uses Lua-based logic to enforce role-based access control on sensitive URIs. The Lua code performs pattern matching directly against the request URI as received on the wire, without applying percent-decoding or path normalization. Nginx, in contrast, decodes and normalizes the URI before selecting the location block that handles the request. This inconsistency between the authorization decision surface and the routing decision surface allows an authenticated user to smuggle a restricted path past the RBAC gate.

The result is a privilege escalation within the application layer. A user holding a low-privilege session cookie can reach endpoints reserved for administrators, including credential management, authentication configuration, and Arkime administrative APIs. The confidentiality and integrity impact is limited to the exposed administrative surface rather than the underlying host.

Root Cause

The root cause is a parser differential between the Lua RBAC layer and the nginx request router. The RBAC layer treats /%68tadmin.php as an unrelated string that does not match its /htadmin restriction pattern. Nginx decodes %68 to h, resolves the URI to /htadmin.php, and dispatches it to the administrative location block. The check-then-use pattern operates on two different representations of the same input.

Attack Vector

An authenticated user issues an HTTP request to a restricted endpoint with one or more path characters replaced by their percent-encoded equivalents. Example transformations include /htadmin becoming /%68tadmin.php, /auth becoming /%61uth, or /admin_login becoming /%61dmin_login. The Lua RBAC check fails to match the encoded string against its deny list, forwards the request, and nginx routes the decoded path to the privileged handler. See the GitHub Security Advisory and CISA ICS Advisory ICSA-26-230-01 for the vendor description.

Detection Methods for CVE-2026-19670

Indicators of Compromise

Access log entries containing percent-encoded alphabetic characters in the path, such as %68, %61, %41, %48, targeting Malcolm administrative routes.
Successful HTTP 200 responses to /htadmin, /auth, /admin_login, or /arkime/api/esadmin from user sessions that lack administrator role membership.
Requests to NetBox or upload endpoints originating from accounts that have never previously accessed those paths.

Detection Strategies

Parse nginx access logs and flag any request path containing % followed by two hex digits where the decoded character is alphabetic; legitimate clients rarely encode letters.
Correlate the authenticated user identity, session role, and requested URI, alerting when a non-admin session reaches an admin-only decoded path.
Compare the raw URI against the decoded URI in log pipelines and raise events when the two forms differ on protected prefixes.

Monitoring Recommendations

Forward Malcolm nginx logs to a centralized analytics platform and retain them long enough to support retrospective hunts.
Baseline normal role-to-endpoint access patterns and alert on deviations, particularly non-admin accounts reaching administrative APIs.
Monitor Arkime and NetBox audit trails for configuration changes initiated by unexpected accounts.

How to Mitigate CVE-2026-19670

Immediate Actions Required

Upgrade Malcolm to a version that includes the fix referenced in GHSA-f2v6-8cj4-mhr6.
Restrict network exposure of the Malcolm web interface to trusted management networks until the patch is applied.
Audit existing user accounts and remove or downgrade any that do not require access.

Patch Information

Refer to the GitHub Security Advisory for the fixed release and to CISA ICS Advisory ICSA-26-230-01 for operational guidance. The remediation aligns the RBAC evaluation with the decoded, normalized URI used by nginx routing.

Workarounds

Place an upstream reverse proxy or web application firewall that rejects or normalizes requests containing percent-encoded alphabetic characters before they reach Malcolm.
Enforce network-level allowlists so only administrator workstations can reach /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, and upload endpoints.
Review nginx location definitions and add explicit deny rules that also match common encoded variants of restricted path segments.

bash

# Example: block percent-encoded alphabetic characters on protected paths
# Add to an upstream nginx or WAF layer
if ($request_uri ~* "^/(%[46][0-9a-f])") {
    return 400;
}