Role-Based Access Control Flaw in Malcolm's Nginx Implementation

CVE-2026-19670

What is CVE-2026-19670?

Malcolm's implementation of role-based access control (RBAC) for Nginx is vulnerable due to a mismatch in the way it processes request URIs. The system performs RBAC checks using the raw, percent-encoded request URI, allowing low-privilege authenticated users to bypass access restrictions. This occurs when users craft requests to admin-only paths using percent-encoding, enabling them to access sensitive areas without proper authorization. The issue arises from the discrepancy between the RBAC checks and how Nginx decodes requests, leading to potential exposure of critical system functionalities.

References