CVE-2026-63177

Received Received - Intake

Path Traversal in Malcolm Network Traffic Analysis Tool

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized `ngx.var.request_uri`, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example `/x/../upload/...`) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-63177

Affected Vendors & Products

Vendor	Product	Version / Range
nginx	openresty	to 26.07.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Malcolm is a network traffic analysis tool. Prior to version 26.07.0, it had a role-based access control flaw in the Nginx OpenResty Lua layer. The system checked raw request URIs for access rules but Nginx itself used normalized paths for routing. An attacker could exploit this by adding path traversal segments like /x/../upload/... to bypass access controls and access restricted areas.

Detection Guidance

Check Malcolm logs for unusual access patterns or requests containing path traversal segments like /x/../. Inspect Nginx OpenResty Lua role-based access control logs for mismatches between normalized and raw URIs.

Impact Analysis

An authenticated low-privilege user could gain unauthorized access to restricted backend functions or data. This could lead to data leaks, unauthorized modifications, or further network compromise depending on what the restricted backend controls.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using vulnerable Malcolm versions may face compliance violations, potential fines, and reputational damage if exploited.

Mitigation Strategies

Upgrade Malcolm to version 26.07.0 or later to fix the role-based access control issue. Review and tighten Nginx OpenResty Lua access rules to ensure normalized paths are used for role checks.

Hi! I’m here to help you understand CVE-2026-63177. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70