CVE-2026-18638

Awaiting Analysis Awaiting Analysis - Queue

Authenticated User-Induced Server Termination in Velociraptor

Publication date: 2026-08-11

Last updated on: 2026-08-28

Assigner: Rapid7, Inc.

Description

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-28

Generated

2026-09-01

AI Q&A

2026-08-11

EPSS Evaluated

2026-08-30

NVD

CVE-2026-18638

EUVD

EUVD-2026-56185

Affected Vendors & Products

Vendor	Product	Version / Range
velociraptor	velociraptor	to 0.77.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.
CWE-703	The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

Attack-Flow Graph

Executive Summary

This vulnerability allows any authenticated Velociraptor user, even with only reader permissions, to crash the entire server by sending a single request to the SetPassword API using a non-existent username. It occurs due to a NULL pointer dereference and improper handling of exceptional conditions.

Detection Guidance

Monitor Velociraptor server logs for crashes or unexpected terminations. Check for repeated failed login attempts or SetPassword API calls with non-existent usernames. Ensure server version is updated to 0.77.2 or later.

Impact Analysis

The impact includes server downtime as the entire Velociraptor server process terminates unexpectedly. This disrupts monitoring, investigation, and management capabilities for all users relying on the server.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized service disruption. A denial-of-service condition could lead to unavailability of critical data processing systems, violating availability requirements under both regulations. GDPR emphasizes data availability and integrity, while HIPAA requires safeguards to ensure access to protected health information.

Mitigation Strategies

Upgrade Velociraptor to version 0.77.2 or later immediately. Restrict user permissions to only what is necessary. Monitor server stability and logs for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-18638. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70