CVE-2026-107334

Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects which location block actually serves the request using the percent-decoded, normalized URI. Because the RBAC check never percent-decodes its input, an authenticated low-privilege user can request an admin-only path using percent-encoding (e.g. /%68tadmin.php) and have nginx route it to the restricted location while the Lua RBAC gate evaluating the un-decoded raw string finds no matching restriction and grants access.

• CWE-863

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json
• https://github.com/cisagov/Malcolm/security/advisories/GHSA-jr6p-63pg-hr6g
• https://github.com/cisagov/Malcolm/security/advisories/GHSA-jr6p-63pg-hr6g

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107322An incomplete list of disallowed inputs in Amazon Agent Plug…7.8
• CVE-2026-107324An integer overflow in BSON value-length handling in the Mon…5.9
• CVE-2026-107325Improper validation of a BSON array length in the MongoDB Go…5.9
• CVE-2026-10733GitLab has remediated an issue in GitLab CE/EE affecting all…4.3
• CVE-2026-107332Insecure file permissions in the CodeCatalyst connection han…5.5
• CVE-2026-107333Malcolm's nginx based reverse proxy contains a URL path norm…8.1
• CVE-2026-107335Malcolm's upload-processing pipeline (scripts/safe-extract.p…6.5
• CVE-2026-107336Malcolm's front nginx reverse proxy defines a "Dashboards → …6.5
• CVE-2026-107337The Malcolm kiosk Flask application exposes a POST /script_c…7.1
• CVE-2026-10734The Infility Global plugin for WordPress is vulnerable to St…7.2
• CVE-2026-10735Multiple Shapedsmart-post-show-pro WordPress plugin before 4…7.5
• CVE-2026-107352Missing authorization checks in Amazon Athena engine version…7.7