CVE-2026-63177

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2026-63177", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-15T22:13:00.720Z", "datePublished": "2026-08-11T20:30:57.901Z", "dateUpdated": "2026-10-02T20:27:08.611Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-10-02T20:27:08.611Z"}, "title": "Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "affected": [{"vendor": "cisagov", "product": "Malcolm", "versions": [{"status": "affected", "version": "< 26.07.0"}, {"status": "unaffected", "version": "26.07.0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized `ngx.var.request_uri`, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example `/x/../upload/...`) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized `ngx.var.request_uri`, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example `/x/../upload/...`) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue.</p>"}]}], "references": [{"url": "https://github.com/cisagov/Malcolm/security/advisories/GHSA-m5fr-rv3h-xg2r", "name": "https://github.com/cisagov/Malcolm/security/advisories/GHSA-m5fr-rv3h-xg2r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/cisagov/Malcolm/releases/tag/v26.07.0", "name": "https://github.com/cisagov/Malcolm/releases/tag/v26.07.0", "tags": ["x_refsource_MISC"]}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-230-01.json"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Malcolm version 26.07.0 addresses these issues. For more information, see\u00a0 https://github.com/cisagov/Malcolm/pull/1043", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Malcolm version 26.07.0 addresses these issues. For more information, see&nbsp;<a href=\"https://github.com/cisagov/Malcolm/pull/1043\">https://github.com/cisagov/Malcolm/pull/1043</a>"}]}], "credits": [{"lang": "en", "value": "pavanchow reported this vulnerability to CISA.", "type": "finder"}], "source": {"advisory": "GHSA-m5fr-rv3h-xg2r", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T22:07:37.481958Z", "id": "CVE-2026-63177", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T22:12:55.745Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63177", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T22:07:37.481958Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T22:07:38.522Z"}}], "cna": {"title": "Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC", "source": {"advisory": "GHSA-m5fr-rv3h-xg2r", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "pavanchow reported this vulnerability to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "cisagov", "product": "Malcolm", "versions": [{"status": "affected", "version": "< 26.07.0"}, {"status": "unaffected", "version": "26.07.0"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Malcolm version 26.07.0 addresses these issues. For more information, see\u00a0 https://github.com/cisagov/Malcolm/pull/1043", "supportingMedia": [{"type": "text/html", "value": "Malcolm version 26.07.0 addresses these issues. For more information, see&nbsp;<a href=\"https://github.com/cisagov/Malcolm/pull/1043\">https://github.com/cisagov/Malcolm/pull/1043</a>", "base64": false}]}], "references": [{"url": "https://github.com/cisagov/Malcolm/security/advisories/GHSA-m5fr-rv3h-xg2r", "name": "https://github.com/cisagov/Malcolm/security/advisories/GHSA-m5fr-rv3h-xg2r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/cisagov/Malcolm/releases/tag/v26.07.0", "name": "https://github.com/cisagov/Malcolm/releases/tag/v26.07.0", "tags": ["x_refsource_MISC"]}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-230-01.json"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized `ngx.var.request_uri`, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example `/x/../upload/...`) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized `ngx.var.request_uri`, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example `/x/../upload/...`) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-10-02T20:27:08.611Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63177", "state": "PUBLISHED", "dateUpdated": "2026-10-02T20:27:08.611Z", "dateReserved": "2026-07-15T22:13:00.720Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-11T20:30:57.901Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Malcolm", "vendor": "cisagov", "versions": [{"status": "affected", "version": "< 26.07.0"}, {"status": "unaffected", "version": "26.07.0"}]}], "source": "ics-cert@hq.dhs.gov"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized `ngx.var.request_uri`, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can prepend a traversal segment (for example `/x/../upload/...`) so that Nginx routes the request to a restricted backend while the Lua role check fails to match any rule and falls open, granting access it should deny. Version 26.07.0 fixes the issue."}, {"lang": "es", "value": "Malcolm es una suite de herramientas de an\u00e1lisis de tr\u00e1fico de red. Antes de la versi\u00f3n 26.07.0, el control de acceso basado en roles implementado en la capa Lua de Nginx OpenResty eval\u00faa la \u2019ngx.var.request_uri\u2019 sin procesar y sin normalizar, mientras que Nginx en s\u00ed mismo enruta las solicitudes utilizando la ruta normalizada. Un usuario autenticado con pocos privilegios puede anteponer un segmento de recorrido (por ejemplo, \u2019/x/.. / upload/...\u2019) de modo que Nginx enrute la solicitud a un backend restringido mientras que la verificaci\u00f3n de rol de Lua no logra coincidir con ninguna regla y queda abierta, otorgando acceso que deber\u00eda denegar. La versi\u00f3n 26.07.0 corrige el problema."}], "id": "CVE-2026-63177", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63177", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-12T22:07:37.481958Z", "version": "2.0.3"}}]}, "published": "2026-08-11T21:17:44.443", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-230-01.json"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://github.com/cisagov/Malcolm/releases/tag/v26.07.0"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://github.com/cisagov/Malcolm/security/advisories/GHSA-m5fr-rv3h-xg2r"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.07.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Malcolm", "source": "cna", "vendor": "cisagov"}, "product": "malcolm", "vendor": "cisagov"}], "created": "2026-08-12T20:15:03.497746+00:00", "updated": "2026-08-13T09:49:09.729172+00:00", "vendors": ["cisagov", "cisagov$PRODUCT$malcolm"]}