Is CVE-2026-19670 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19670 being exploited in the wild.

How severe is CVE-2026-19670?

Medium severity, with a CVSS score of 5.4, published 18 August 2026.

Is there a fix for CVE-2026-19670?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-19670 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-19670?

Check whether you run CISA Malcolm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19670: CISA Malcolm nginx Lua RBAC bypass via percent-encoding

CVE-2026-19670 · Severity: medium · CVSS 5.4 · Published 2026-08-18

Malcolm is a network traffic analysis platform used to monitor and investigate network communications. Its authentication layer validates user access to restricted administrative paths, but fails to properly decode URL-encoded characters before checking permissions. An authenticated low-privilege user can request admin-only pages using URL encoding tricks (e.g., /%68tadmin instead of /htadmin) to bypass access controls and reach sensitive functionality they should not have access to.

Technologies: CISA Malcolm. Vendors: CISA.

Quick answers

Is CVE-2026-19670 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19670 being exploited in the wild.
How severe is CVE-2026-19670?: Medium severity, with a CVSS score of 5.4, published 18 August 2026.
Which products and versions are affected?: CISA Malcolm <=26.07.1.
Is there a fix for CVE-2026-19670?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19670 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-19670?: Check whether you run CISA Malcolm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in Malcolm's nginx Lua RBAC layer caused by inconsistent URL decoding between the access control check and nginx's request routing logic. The Lua gate evaluates restrictions against the raw, percent-encoded request URI, while nginx itself routes requests using the decoded and normalized URI. An authenticated attacker can percent-encode path components (e.g., %68 for 'h') so the Lua check sees no matching restriction pattern and grants access, but nginx then routes the request to the restricted location block. This affects admin paths including /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, and upload endpoints. The fix requires the RBAC layer to decode URIs before pattern matching.

Affected products

CISA Malcolm <=26.07.1

Timeline

2026-08-18: disclosed
2026-08-18: advisory: CISA ICSA-26-230-01

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.