CVE-2026-18638
Received Received - Intake

Authenticated User-Induced Server Termination in Velociraptor

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Rapid7, Inc.

Description
Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-18638
EUVD
EUVD-2026-56185

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
velociraptor velociraptor to 0.77.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-703 The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows any authenticated Velociraptor user, even with only reader permissions, to crash the entire server by sending a single request to the SetPassword API using a non-existent username. It occurs due to a NULL pointer dereference and improper handling of exceptional conditions.

Detection Guidance

Monitor Velociraptor server logs for crashes or unexpected terminations. Check for repeated failed login attempts or SetPassword API calls with non-existent usernames. Ensure server version is updated to 0.77.2 or later.

Impact Analysis

The impact includes server downtime as the entire Velociraptor server process terminates unexpectedly. This disrupts monitoring, investigation, and management capabilities for all users relying on the server.

Mitigation Strategies

Upgrade Velociraptor to version 0.77.2 or later immediately. Restrict user permissions to only what is necessary. Monitor server stability and logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18638. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart