CISA Malcolm: Remediation of RCE and RBAC Bypass Vulnerabilities

Source context: this article examines information published by the source on August 18, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.

What the vulnerability is

CISA has identified several vulnerabilities in the Malcolm network traffic analysis tool suite that could allow authenticated users to execute arbitrary code, bypass role-based access controls (RBAC), or cause a denial-of-service (DoS) condition.

The most severe flaw involves an unrestricted file upload mechanism where an empty allow-list and lack of extension sanitization permit users with the ROLE_UPLOAD role to upload and execute arbitrary PHP code as the www-data user. Additionally, discrepancies between how the Nginx Lua layer and the Nginx core handle URI normalization—specifically regarding unnormalized paths and percent-encoding—allow low-privilege users to access restricted administrative endpoints.

Resource exhaustion vulnerabilities also exist in the archive extraction process. These include a lack of limits on entry counts during extraction (leading to inode exhaustion) and a failure to apply decompression limits to single-stream compressed formats like .gz or .bz2, which could allow “gzip bombs” to exhaust shared Docker volumes.

Exposure and applicability

The vulnerabilities affect different version ranges of the Malcolm suite:

• CVE-2026-55676 (RCE): Affects versions prior to 26.06.1.
• CVE-2026-63133, CVE-2026-63134, and CVE-2026-63177 (DoS/Path Traversal/RBAC Bypass): Affect versions prior to 26.07.0.
• CVE-2026-19670 and CVE-2026-19671 (RBAC Bypass/DoS): Affect versions up to and including 26.07.1.

These flaws are applicable to any deployment of Malcolm utilizing RBAC or the file-upload component. The risk is highest in environments where low-privilege users are granted upload permissions or where the tool suite is exposed to untrusted authenticated users.

Remediation priorities

Our analysis suggests prioritizing updates based on the potential for system compromise versus service disruption:

1. Immediate Priority: Update to version 26.06.1 (or later). This addresses the RCE vulnerability (CVE-2026-55676), which presents the highest risk of full container compromise.
2. High Priority: Update to version 26.07.0 (or later). This remediates the first set of RBAC bypasses and path traversal issues, preventing unauthorized access to restricted backends.
3. Secondary Priority: Update to version 26.08.0 (or later). This addresses the percent-encoding RBAC bypass and the single-stream compression DoS vulnerability.

How to validate remediation

Updating the software version is the primary corrective action, but a version check alone does not prove that the exposure has been reduced in a live environment. Defenders should verify the following:

• RBAC Enforcement: Test whether an account with low privileges can access administrative paths (e.g., /htadmin or /admin_login) using percent-encoded characters or traversal segments (e.g., /x/../). A successful mitigation will result in a 403 Forbidden or similar authorization error.
• Upload Restrictions: Verify that the file-upload component no longer accepts .php extensions and that uploaded files cannot be executed via the web server.
• Resource Limits: For those managing infrastructure, monitor Docker volume utilization during the upload of large or highly compressed files to ensure extraction limits are being enforced.

Limits and open questions

While updating to the latest version addresses the reported CVEs, residual risk remains if the underlying host or container orchestration layer is misconfigured. The source does not specify if these vulnerabilities could be leveraged to escape the Docker container to the host system; it only notes execution as www-data within the file-upload container.

Furthermore, while CISA recommends using VPNs and firewalls to minimize network exposure, these are compensating controls that limit reachability rather than fixing the underlying software flaws. The effectiveness of these measures depends entirely on the strictness of the access control lists (ACLs) implemented by the organization.

Source and editorial note

CISA Malcolm · Source date: August 18, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment