Intelligence online17 sources monitored16 actively exploited 7d25 published 24hChecked recently
Vulnerability record

CVE-2026-107333

HighNo known exploitation

Patch status

No official fix confirmed yet

Until a fix ships, follow the vendor's mitigations, limit exposure of affected systems, and watch this record for a patch.

Description

Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach administrative or role gated endpoints they should not have access to. This affects all restricted paths protected by the RBAC authorization layer, including file upload, PHP server, htadmin, and authentication management interfaces.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Intelligence timeline

Developments from the last 30 days, newest first.

  1. CVSS scoredUpdate

    CVE-2026-107333 scored CVSS 8.1

    Basis: NIST National Vulnerability Database

Coverage

HighReview

CISA Malcolm

CISA Cybersecurity AdvisoriesEnterpriseDevelopersCritical infra

References

  • github.com https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json
  • github.com https://github.com/cisagov/Malcolm/security/advisories/GHSA-v66f-cwcm-hf73