CVE-2026-63177: Malcolm Privilege Escalation Vulnerability

CVE-2026-63177 Overview

Malcolm is a network traffic analysis tool suite maintained by CISA. CVE-2026-63177 is an authorization bypass vulnerability [CWE-863] affecting Malcolm versions prior to 26.07.0. The flaw exists in the role-based access control (RBAC) enforcement in the Nginx OpenResty Lua layer, which evaluates the raw, unnormalized ngx.var.request_uri while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment such as /x/../upload/... to reach restricted backends. Version 26.07.0 resolves the issue.

Critical Impact
Authenticated low-privilege users can bypass role-based access control to reach restricted backend endpoints, exposing sensitive functionality intended for higher-privileged accounts.

Affected Products

CISA Malcolm network traffic analysis suite versions prior to 26.07.0
Deployments relying on the Nginx OpenResty Lua RBAC layer
Fixed in Malcolm version 26.07.0

Discovery Timeline

2026-08-11 - CVE-2026-63177 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-63177

Vulnerability Analysis

The vulnerability arises from inconsistent URI handling between two components in the request pipeline. Nginx normalizes the request path when performing routing, collapsing traversal sequences such as ../ before matching location blocks. The OpenResty Lua RBAC layer, however, inspects ngx.var.request_uri, which contains the raw, unnormalized URI as sent by the client.

This desynchronization allows a crafted URI to route to a privileged backend while the Lua rule matcher fails to identify the effective path. When no rule matches, the RBAC logic fails open and permits the request. An authenticated user with minimal privileges can therefore invoke endpoints reserved for administrative or higher-privileged roles.

Root Cause

The root cause is a parser differential [CWE-863] between Nginx path normalization and the Lua-based authorization check. The Lua layer applies rules against the literal request URI without normalizing traversal segments, dot segments, or duplicate slashes. Because the authorization decision defaults to allow when no rule matches, any URI form that evades the rule set grants access to whatever endpoint Nginx ultimately routes to.

Attack Vector

Exploitation requires network access to the Malcolm web interface and valid low-privilege credentials. An attacker constructs a URI that includes a dummy segment followed by a traversal sequence, for example /x/../upload/.... Nginx normalizes this to /upload/... and forwards the request to the restricted backend. The Lua matcher evaluates the raw string, finds no matching rule for the traversal-prefixed path, and permits the request. The result is unauthorized access to functionality gated behind higher-privilege roles.

See the GitHub Security Advisory GHSA-m5fr-rv3h-xg2r for additional technical detail.

Detection Methods for CVE-2026-63177

Indicators of Compromise

Nginx access log entries containing traversal segments such as /../ or /./ in the request URI targeting Malcolm endpoints
Requests to restricted paths (for example /upload/, administrative endpoints) originating from accounts that do not hold the required role
HTTP 200 responses to authenticated requests that should have been denied based on the requester's role

Detection Strategies

Parse Nginx access logs for URIs containing .., encoded traversal sequences (%2e%2e), or duplicate slashes and correlate with the authenticated user's role
Compare the raw request URI recorded by Nginx with the effective backend location to identify normalization mismatches
Alert on any low-privilege session accessing restricted upload, configuration, or administrative endpoints

Monitoring Recommendations

Enable verbose Nginx logging including $request_uri and $uri to expose normalization differences
Forward Malcolm web-tier logs to a centralized SIEM or data lake for correlation across sessions and roles
Baseline expected endpoint access per role and alert on deviations

How to Mitigate CVE-2026-63177

Immediate Actions Required

Upgrade Malcolm to version 26.07.0 or later, which corrects the RBAC evaluation logic
Audit Nginx and Malcolm access logs for prior requests containing traversal segments against restricted endpoints
Rotate credentials for any low-privilege accounts suspected of exploiting the bypass

Patch Information

The fix is available in Malcolm Release v26.07.0. The patch aligns the Lua authorization evaluation with the normalized path used by Nginx routing, ensuring both components operate on the same URI representation.

Workarounds

Restrict network exposure of the Malcolm web interface to trusted administrative networks until the patch is applied
Add an upstream reverse proxy or WAF rule that rejects requests containing ../, ..%2f, or encoded traversal sequences
Temporarily disable low-privilege user accounts if upgrade cannot be performed immediately

bash

# Example WAF/Nginx rule to reject traversal segments prior to patching
location / {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 400;
    }
}