CVE-2026-63177 Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC
Low-privilege users can bypass RBAC restrictions in Malcolm by exploiting URI normalization differences between Nginx and Lua, gaining unauthorized access to restricted features.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-63177?
CVE-2026-63177 is a high-severity authentication bypass vulnerability in cisagov Malcolm, published on 11 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized `ngx.var.request_uri`, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example `/x/../upload/...`) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue.
Weakness: CWE-863
Which versions are affected by CVE-2026-63177?
How do I fix CVE-2026-63177?
No fix has been published for CVE-2026-63177 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-63177 being exploited?
There is no known exploitation of CVE-2026-63177 in the wild and no public exploit code.
Sources
Also known as GHSA-m5fr-rv3h-xg2r.