CVE-2026-63177

Name of the Vulnerable Software and Affected Versions Malcolm versions prior to 26.07.0

Description Role-based access control in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.request uri variable, whereas Nginx routes requests using the normalized path. An authenticated user with low privileges can bypass access restrictions by prepending a traversal segment to the request, causing the Lua role check to fail to match any rule and grant unauthorized access to restricted backends.

Recommendations Update to version 26.07.0.