CVE-2026-18972
Received Received - Intake

Authenticated Session Spoofing in Zabbix GUI via Custom Header

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Rapid7, Inc.

Description
An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack from a user with low privileges to administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-18972
EUVD
EUVD-2026-56127

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
velociraptor velociraptor to 0.77.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authenticated identity-spoofing vulnerability in Velociraptor where an attacker with access to the GUI can impersonate another user by sending a custom header called 'Grpc-Metadata-USER'. This allows them to take over the victim's account and escalate privileges from a low-level user to an administrator.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to the Velociraptor GUI for the presence of the custom header 'Grpc-Metadata-USER'. Check server logs for suspicious requests with this header, especially from low-privilege users. Ensure Velociraptor is updated to version 0.77.2 or later.

Impact Analysis

An attacker could gain unauthorized access to your Velociraptor account, steal sensitive data, perform administrative actions, or escalate their own privileges to take full control of the system. This could lead to data breaches or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using vulnerable Velociraptor versions may face compliance violations and potential fines.

Mitigation Strategies

Immediately update Velociraptor to version 0.77.2 or later. If using a proxy, block the 'Grpc-Metadata-USER' header. Restrict access to the Velociraptor GUI to trusted users only. Review logs for any signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18972. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart