PT-2026-62012 · Malcolm · Malcolm
CVE-2026-63177
·
Published
2026-07-21
·
Updated
2026-08-11
CVSS v3.1
7.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Malcolm versions prior to 26.07.0
Description
Role-based access control in the Nginx OpenResty Lua layer evaluates the raw, unnormalized
ngx.var.request uri variable, whereas Nginx routes requests using the normalized path. An authenticated user with low privileges can bypass access restrictions by prepending a traversal segment to the request, causing the Lua role check to fail to match any rule and grant unauthorized access to restricted backends.Recommendations
Update to version 26.07.0.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Malcolm