Role-Based Access Control Vulnerability in Malcolm's NGiNX Reverse Proxy

CVE-2026-107333

What is CVE-2026-107333?

Malcolm's nginx-based reverse proxy is prone to a vulnerability due to an inconsistency in URL path normalization between its Lua-based role-based access control (RBAC) layer and nginx's request routing logic. Authenticated users can exploit this flaw by crafting specific request paths, which allows them to bypass role-based restrictions. This unauthorized access can lead to exposure of sensitive endpoints such as file uploads, PHP servers, administrative interfaces, and authentication management, compromising the security of the affected system.

References