CVE-2026-19670

Received Received - Intake

Malcolm nginx Lua RBAC Bypass via Percent-Encoded URI

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: ICS-CERT

Description

Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects which location block actually serves the request using the percent-decoded, normalized URI. Because the RBAC check never percent-decodes its input, an authenticated low-privilege user can request an admin-only path using percent-encoding (e.g. /%68tadmin.php) and have nginx route it to the restricted location while the Lua RBAC gate evaluating the un-decoded raw string finds no matching restriction and grants access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-19670

EUVD

EUVD-2026-61157

Affected Vendors & Products

Vendor	Product	Version / Range
malcolm	nginx_lua_role_based_access_control	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Malcolm's nginx Lua role-based access control (RBAC) layer checks the raw percent-encoded request URI to determine if an authenticated user can access admin paths like /htadmin or /admin_login. However, nginx itself uses the percent-decoded URI to route requests. This mismatch allows an attacker to bypass RBAC by using percent-encoding in the request (e.g., /%68tadmin.php), which nginx decodes to /htadmin.php but the RBAC layer evaluates the un-decoded string, granting unauthorized access to admin-only paths.

Impact Analysis

An authenticated low-privilege user could gain unauthorized access to admin-only endpoints, potentially allowing them to perform privileged actions like viewing sensitive data, modifying configurations, or disrupting services. If the system is misconfigured with no authentication (NGINX_AUTH_MODE=no_authentication), even unauthenticated users could exploit this to access restricted paths.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. It may result in data breaches, unauthorized modifications, or service disruptions, all of which are non-compliant with these regulations' security and privacy controls.

Mitigation Strategies

Update Malcolm to a version beyond v26.07.1 where the vulnerability is patched. Ensure the functions _extract_raw_stream() and _extract_lzip() enforce size limits like _extract_libarchive(). Disable upload privileges for untrusted users if possible.

Hi! I’m here to help you understand CVE-2026-19670. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70