Rapid7CVE-2026-18348
Rapid7 Velociraptor: missing authorization
Medium4.1CVE-2026-18348 · Published Aug 11, 2026 · updated Aug 28, 2026
Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Velociraptor Product | < 0.77.2 | 0.77.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-863
More Rapid7 advisories
All Rapid7| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 11 | Rapid7 Velociraptor: null pointer dereference | Medium6.5 | 0.77.2 |
| Aug 11 | Rapid7 Velociraptor: authentication bypass by spoofing | High7.3 | 0.77.2 |
| Aug 11 | Rapid7 Velociraptor: path traversal | High7.1 | 0.77.2 |
| Aug 11 | Rapid7 Velociraptor: improper authorization | High7.2 | 0.77.2 |
| Aug 11 | Rapid7 Velociraptor: authentication bypass | Medium6.8 | 0.77.2 |
| Aug 11 | Rapid7 Velociraptor: improper permission handling | High8.7 | 0.77.2 |