CVE-2026-19670

Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects which location block actually serves the request using the percent-decoded, normalized URI. Because the RBAC check never percent-decodes its input, an authenticated low-privilege user can request an admin-only path using percent-encoding (e.g. /%68tadmin.php) and have nginx route it to the restricted location while the Lua RBAC gate evaluating the un-decoded raw string finds no matching restriction and grants access.

• CWE-863

• https://github.com/cisagov/Malcolm/security/advisories/GHSA-f2v6-8cj4-mhr6
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-230-01
• https://github.com/cisagov/Malcolm/security/advisories/GHSA-f2v6-8cj4-mhr6

Published

Aug 18, 2026

Last Modified

Sep 8, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19657ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML r…6.1
• CVE-2026-1966YugabyteDB Anywhere displays LDAP bind passwords configured …2.4
• CVE-2026-19662An attacker may be able to cause a `named` resolver to abort…5.9
• CVE-2026-19666On a resolver configured to use ``dns64``, if an applicable …7.5
• CVE-2026-19667If an attacker-controlled authoritative server can produce a…7.5
• CVE-2026-19668A BIND recursive resolver may experience excessive resource …5.3
• CVE-2026-19671Malcolm's upload-processing pipeline (scripts/safe-extract.p…6.5
• CVE-2026-19672The tarfile module's tar and data extraction filters create…6.3
• CVE-2026-19679An input validation vulnerability exists in Security Center'…8.8
• CVE-2026-19680A SQL injection vulnerability exists in Security Center that…7.1
• CVE-2026-19681An authenticated command injection vulnerability exists in S…9.9
• CVE-2026-19682A command injection vulnerability exists in Security Center …9.9