CVE-2026-63177

This vulnerability exposes a critical consistency requirement in layered enforcement architectures. The technical mechanism is straightforward: Nginx normalizes request paths during routing (resolving `..` and canonicalizing), while the Lua RBAC layer evaluates the raw, non-normalized URI string. An attacker uses path traversal sequences to access restricted backends because the Lua layer sees a different path representation than Nginx acted on. The most dangerous aspect is the fall-open behavior. The Lua RBAC module grants access when no rule matches — meaning a path traversal that produces a non-matching string receives implicit allowance rather than explicit denial. This inverts the expected whitelist model under edge cases. The path traversal is merely the trigger; the inverted authorization logic is the root cause. The patch in version 26.07.0 normalizes the path before Lua evaluation, which closes this specific instance. However, this should prompt harder questions about your deployment. If you have multi-layer enforcement — infrastructure-level routing plus application-layer authorization — verify that both layers operate on identical path representations. The normalization step must be centralized and consistently applied before any authorization decision, and future code changes must be tested against this invariant. More importantly, this is not a novel vulnerability class. The pattern of normalization gaps between enforcement layers has CVE lineage dating back to at least 2014 (CVE-2014-0133, CVE-2019-9978, CVE-2021-43297). Organizations should treat known vulnerability patterns as immediate architectural debt requiring remediation prior to deployment, not after external disclosure. The systemic issue is additive security layers without treating the seam between them as a mandatory verification point.

Reviewed through automated stages and approved by a human before publication.