Threat Intelligence Database

CVE-2026-18640 is a path traversal vulnerability in Rapid7 Velociraptor's NewNotebook API. It allows an authenticated user with NOTEBOOK_EDIT permission to write files outside the intended data store directory. The vulnerability permits overwriting metadata files with a .json.db extension, potentially causing data corruption. The issue affects versions prior to 0.77.2. The CVSS score is 7.1, indicating high severity.

CVE-2026-18639 is an authentication bypass vulnerability in Rapid7 Velociraptor when configured with an OIDC identity provider (IdP). The product uses the email claim from the IdP as the username, but some IdPs allow users to change the email claim without verification or do not verify the email at all. This flaw enables an attacker to impersonate another user by setting their email address in the IdP, leading to account takeover.

CVE-2026-18638 is a medium severity vulnerability in Rapid7 Velociraptor versions prior to 0.77.2. It allows any authenticated user, including those with only reader role privileges, to cause a denial of service by terminating the entire server process. This is triggered by sending a SetPassword request with a username that does not exist, resulting in a NULL pointer dereference.

CVE-2026-18860 is a vulnerability in Rapid7 Velociraptor affecting multi-tenant deployments. It allows administrators of child organizations to delete other organizations by exploiting improper permission checks. The flaw arises because the server checks ORG_ADMIN permissions within the calling org instead of the ROOT org, enabling privilege escalation within the deployment.

CVE-2026-18636 is an authentication bypass vulnerability in Rapid7 Velociraptor's gRPC API VFSGetBuffer endpoint. The endpoint allows reading files from the datastore and uses a prefix check to block access to sensitive files and other organizations' data. However, this prefix check can be bypassed, enabling users with read permission in the ROOT organization to access files from other organizations where they lack permission. This vulnerability affects versions prior to 0.77.2 and has a medium severity rating with a CVSS score of 6.8.

CVE-2026-17535 is a medium severity vulnerability in Rapid7 Velociraptor's NTFS parsing library. It involves out-of-bounds read and memory exhaustion issues triggered by maliciously crafted NTFS images. The vulnerability mainly affects scenarios where Velociraptor processes untrusted NTFS image files, such as dead disk forensics. Exploitation can cause application crashes leading to denial of service. No data confidentiality or integrity impact is reported. The vulnerability affects Velociraptor versions prior to 0.77.2. There is no confirmed patch or official remediation available at this time.

CVE-2026-18635 is a vulnerability in Rapid7 Velociraptor prior to version 0.77.2 where the VQL query() plugin incorrectly evaluates the IMPERSONATE permission against the caller's organization instead of the target organization. This flaw allows an administrator in one organization to impersonate a user in another organization without having the proper permission in that target organization.

An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack from a user with low privileges to administrator.

Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.