This vulnerability (CVE-2026-18972) in Rapid7 Velociraptor involves an authentication bypass via spoofing the 'Grpc-Metadata-USER' HTTP header. An attacker who is already authenticated with low privileges can impersonate another user, including administrators, by crafting requests with this header. This leads to a complete account takeover and elevated privileges. The CVSS 3.1 base score is 9.6, reflecting critical severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability affects versions prior to 0.77.2. No official patch or remediation guidance has been published by the vendor as of the data provided.

An attacker with valid low-level credentials can escalate privileges to administrator by spoofing the user identity header, resulting in full account takeover. This compromises confidentiality and integrity of the system and administrative controls. Availability is not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious use of the 'Grpc-Metadata-USER' header in requests. Avoid exposing the Velociraptor GUI to untrusted networks.