CVE-2026-18635
Received Received - Intake

Privilege Escalation in Velociraptor VQL query() Plugin

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Rapid7, Inc.

Description
Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller's org instead of against the target org. This allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-18635
EUVD
EUVD-2026-56153

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rapid7 velociraptor to 0.77.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Velociraptor's VQL query() plugin allows administrators in one organization to impersonate users in another organization where they lack the IMPERSONATE permission. The issue occurs because versions prior to 0.77.2 incorrectly check permissions against the caller's organization instead of the target organization.

Detection Guidance

Check Velociraptor version with 'velociraptor version'. If it is below 0.77.2, the system is vulnerable. Review logs for unusual VQL query() plugin usage across organizations.

Impact Analysis

An attacker with administrator privileges in their own organization could exploit this to impersonate users in other organizations, potentially gaining unauthorized access to sensitive data or systems. This could lead to data breaches, privilege escalation, or further attacks within the target organization.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements such as GDPR or HIPAA. Organizations may face legal penalties, reputational damage, and loss of trust due to data breaches resulting from this flaw.

Mitigation Strategies

Upgrade Velociraptor to version 0.77.2 or later. Restrict IMPERSONATE permission to only trusted administrators in child organizations. Monitor for unauthorized cross-organization impersonation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18635. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart