Malcolm: Authorization bypass in RBAC via unresolved /./ path segments
Summary
Malcolm's nginx reverse proxy and its Lua-based role-based access control (RBAC) layer normalize URL paths differently, so the access check does not see the same path that nginx routes. An authenticated user with a low-privileged role can add a "/./" segment to a request and reach role-restricted endpoints such as file upload, PHP server, htadmin and authentication management. The issue only applies to deployments that use Keycloak authentication with RBAC enabled; Basic-auth deployments are not affected.
Affected
- Malcolm with Keycloak authentication and role-based access enabled.
- Versions up to and including v26.08.0 according to the GitHub advisory GHSA-v66f-cwcm-hf73 and the CISA advisory.
- Conflicting data: the CVE record lists 0 to 26.07.1 as affected and 26.08.0 as unaffected. Verify the exact boundary against the vendor advisory.
Fixed in
- Upgrade to Malcolm v26.09.0 or later (per the GitHub advisory and the release notes).
- Note: the CVE record names v26.08.0 as the update target; use v26.09.0 because it contains the documented fix.
Workaround
- No vendor workaround is documented.
- Restrict network access to the Malcolm web interface until the update is applied.
Exploitation
- CISA reports no known public exploitation.
- It is unknown whether public proof-of-concept code exists.
Our recommendation
- Check whether your Malcolm deployment uses Keycloak with RBAC; if so, treat this as high priority.
- Update to v26.09.0 or later.
- Review user accounts and roles, and check logs for unexpected access to /upload, /server/php, /htadmin and /auth paths.
- Limit network exposure of Malcolm to trusted administrators.
- Patch together with the other Malcolm vulnerabilities from the same CISA advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICS Advisory ICSA-26-280-01 www.cisa.gov
- CSAF file ICSA-26-280-01 (GitHub) github.com
- GitHub Security Advisory GHSA-v66f-cwcm-hf73 github.com
- Malcolm issue #1106 github.com
- Malcolm pull request #1126 (v26.09.0) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:32.
Original description (NVD)
Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach administrative or role gated endpoints they should not have access to. This affects all restricted paths protected by the RBAC authorization layer, including file upload, PHP server, htadmin, and authentication management interfaces.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.