## Summary
Malcolm versions prior to 26.07.0 contain an RBAC bypass in the Nginx OpenResty Lua layer. An authenticated low-privilege user can use a path traversal prefix in the raw ngx.var.request_uri so Nginx routes to a restricted backend while the Lua RBAC check fails to match and falls open, granting access it should deny.
## Technical Details
- Root cause: check_rbac in nginx/lua/nginx_auth_helpers.lua extracts the path from the raw, unnormalized ngx.var.request_uri (e.g., local uri = ngx.var.request_uri:match("^[^?]+") or "").
- RBAC matching: get_allowed_roles_for_path(uri) compares the extracted raw path against path_role_envs.
- Fail-open behavior: when no pattern matches, check_rbac returns ngx.HTTP_OK (unmatched path treated as unrestricted).
- Exploit technique: prepend a traversal segment such as /x/../upload/... so that:
- Nginx normalizes the path for routing (e.g., /x/../upload/ routes to the /upload location), but
- Lua RBAC evaluates the raw URI prefix (/x/...) which does not match any RBAC rule, triggering the fail-open path.
- Role propagation nuance: after check_rbac returns OK, Nginx forwards the user’s real roles via headers built from the id token (e.g., X-Forwarded-Roles in nginx/nginx_auth_keycloak.conf). Backends that re-check these headers will deny; others that rely only on the Lua gate may allow.
## Affected
- Malcolm versions prior to 26.07.0.
## Impact
- Confidentiality: High / Integrity: Low for backends that do not natively interpret X-Forwarded-Roles and rely on the Nginx Lua RBAC gate.
- Example backends mentioned: OpenSearch Dashboards and NetBox.
## Mitigation
1. Upgrade Malcolm to v26.07.0 (fix included).
2. Review whether downstream backends re-check X-Forwarded-Roles; ensure they enforce authorization independently of the Nginx Lua gate.
3. Validate RBAC logic to avoid evaluating raw ngx.var.request_uri for authorization decisions; ensure normalization is applied consistently before matching.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CWE-863