CVE-2026-107334 CISA CVE debrief

Who should care

Defenders responsible for the security of Malcolm deployments should be aware of this vulnerability and take steps to verify the presence of the vulnerability in their systems, assess the potential impact, and apply patches or updates as needed.

Why it matters

CVE-2026-107334 is an Incorrect Authorization vulnerability in Malcolm that allows low-privilege users to access admin-only paths via URL encoding. Defenders should verify the presence of this vulnerability, assess the potential impact, and prioritize patching or updating Malcolm to prevent unauthorized access.

• An authenticated low-privilege user may be able to access admin-only paths and perform actions that should be restricted.
• Defenders need to verify the presence of this vulnerability in their Malcolm deployments and assess the potential impact.
• The vulnerability requires verification of access controls and RBAC configurations to prevent unauthorized access.
• Patching or updating Malcolm to a version that addresses this vulnerability should be a priority.

Technical summary

The vulnerability is caused by a mismatch between how nginx and its Lua RBAC layer handle URL encoding. The RBAC layer checks access permissions based on the raw, percent-encoded request URI, while nginx uses the percent-decoded, normalized URI to determine which location block serves the request. This allows an authenticated low-privilege user to access admin-only paths by percent-encoding the URL.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their Malcolm deployments and assess the potential impact of unauthorized access to restricted paths.

Recommended defensive actions

• Verify the version of Malcolm in use and compare it to the affected versions listed in the CVE record.
• Review access controls and RBAC configurations to ensure that they are properly implemented and restrictive enough to prevent unauthorized access.
• Consider applying patches or updates provided by the vendor, if available.
• Monitor system logs for any suspicious activity related to URL encoding and access to restricted paths.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description, affected versions, and references to additional information. However, the corpus does not provide explicit information about exploitation or specific attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.