CVE-2026-18636
Received Received - Intake

Path Traversal in Velociraptor gRPC API

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Rapid7, Inc.

Description
The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to access usually denied files. If the user has read permission in the ROOT org, this allows access to other orgs, in which the user may not have permission.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-18636
EUVD
EUVD-2026-56178

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
velociraptor velociraptor to 0.77.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-288 The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Velociraptor gRPC API's VFSGetBuffer endpoint, which reads files from the datastore. A path deny list prevents access to sensitive files or other organizations' data by checking requested paths. However, this check can be bypassed, allowing unauthorized file access. If a user has read permissions in the ROOT organization, they can exploit this to access files in other organizations where they lack permissions.

Detection Guidance

Check Velociraptor version with 'velociraptor version' command. If version is below 0.77.2, the system is vulnerable. Monitor gRPC API logs for unusual file access patterns or requests to denied paths.

Impact Analysis

If you have the 'reader' role in the ROOT organization, an attacker could exploit this to read files from other organizations where you lack permissions. This could lead to unauthorized data exposure or information leakage.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) by exposing confidential information.

Mitigation Strategies

Upgrade Velociraptor to version 0.77.2 or later immediately. Review user permissions in ROOT organization and restrict 'reader' role access. Monitor file access logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18636. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart