Rapid7CVE-2026-18638

Rapid7 Velociraptor: null pointer dereference

Medium6.5CVE-2026-18638 · Published Aug 11, 2026 · updated Aug 28, 2026

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.

Rapid7 advisory

Affected versions

Package	Affected	Fixed in
Velociraptor Product	< 0.77.2	0.77.2

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-476, CWE-703

More Rapid7 advisories

All Rapid7

Date	Advisory	Severity	Fixed in
Aug 11	Rapid7 Velociraptor: authentication bypass by spoofing High7.3Aug 11 CVE-2026-186390.77.2	High7.3	0.77.2
Aug 11	Rapid7 Velociraptor: path traversal High7.1Aug 11 CVE-2026-186400.77.2	High7.1	0.77.2
Aug 11	Rapid7 Velociraptor: improper authorization High7.2Aug 11 CVE-2026-186350.77.2	High7.2	0.77.2
Aug 11	Rapid7 Velociraptor: authentication bypass Medium6.8Aug 11 CVE-2026-186360.77.2	Medium6.8	0.77.2
Aug 11	Rapid7 Velociraptor: improper permission handling High8.7Aug 11 CVE-2026-188600.77.2	High8.7	0.77.2
Aug 11	Rapid7 Velociraptor: denial of service Medium6.2Aug 11 CVE-2026-175350.77.2	Medium6.2	0.77.2

Affected versions

More Rapid7 advisories

Critical advisories by email