CVE-2026-107333

HIGH 8.1

Published 2026-10-08 · Last modified 2026-10-14

Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach administrative or role gated endpoints they should not have access to. This affects all restricted paths protected by the RBAC authorization layer, including file upload, PHP server, htadmin, and authentication management interfaces.

ELEVATED IMPACT

Severe if exploited (CVSS 8.1), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

1.0%chance of exploitation in 30 days · 62nd percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

8.1CVSS 3.1 · HIGH

ConfidentialityHigh
IntegrityHigh
AvailabilityNone

What an attacker needs

✓Access: Reachable over the network — no local access needed
⚠Privileges: Requires a low-privilege account
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot: 2026-10-26T13:52:32.101Z

Affected

Vendors Cisa

Products Malcolm

Weakness (CWE)

CWE-863: Incorrect Authorization

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References and research data (JSON)

All CVSS metrics

HIGH 8.1 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
HIGH 8.1 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

Advisories

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json government-resourceCVE record · icscert · Updated 2026-10-14T19:34:22.634Z
NVD · CVE-2026-107333 · Updated 2026-10-08T21:03:43.847
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-95117 ADVISORYEUVD · EUVD-2026-95117

Technical & other

https://github.com/cisagov/Malcolm/security/advisories/GHSA-v66f-cwcm-hf73CVE record · icscert · Updated 2026-10-14T19:34:22.634Z
NVD · CVE-2026-107333 · Updated 2026-10-08T21:03:43.847

Sources: NVD · CVE.org · EPSS