CVE-2026-63177

🗓️ 11 Aug 2026 20:30:57Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 82 Views🌐 WEB

Malcolm before 26.07.0 allows auth bypass via Nginx Lua RBAC using unnormalized request_uri traversal.

Reporter	Title	Published	Views	Family All 10
attackerkb	CVE-2026-63177	11 Aug 202620:30	–	attackerkb
Circl	CVE-2026-63177	22 Jul 202614:30	–	circl
Cvelist	CVE-2026-63177 Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC	11 Aug 202620:30	–	cvelist
EUVD	EUVD-2026-56972	11 Aug 202620:30	–	euvd
ICS	CISA Malcolm	18 Aug 202606:00	–	ics
Mend	CVE-2026-63177	11 Aug 202620:30	–	mend
NVD	CVE-2026-63177	11 Aug 202621:17	–	nvd
Positive Technologies	PT-2026-62012	21 Jul 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-63177: Incorrect Authorization	11 Aug 202600:00	–	rapid7
Vulnrichment	CVE-2026-63177 Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC	11 Aug 202620:30	–	vulnrichment

[
  {
    "vendor": "cisagov",
    "product": "Malcolm",
    "versions": [
      {
        "status": "affected",
        "version": "< 26.07.0"
      },
      {
        "status": "unaffected",
        "version": "26.07.0"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
github	www.github.com/cisagov/Malcolm/releases/tag/v26.07.0
cisa	www.cisa.gov/news-events/ics-advisories/icsa-26-230-01
github	www.github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-230-01.json
github	www.github.com/cisagov/Malcolm/security/advisories/GHSA-m5fr-rv3h-xg2r

Parameter	Position	Path	Description	CWE
request_uri	path	/x/../upload/...	Authenticated low-privilege user can bypass RBAC by using a path traversal in the request URI (e.g., /x/../upload/...), causing Nginx to route to a restricted backend while the Lua RBAC check fails to match any rule.	CWE-863

02 Oct 2026 21:16Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.1

CVSS 47.1

EPSS0.00369

SSVC

CWE-863