EUVD-2026-56185
GHSA-79v4-qf48-mh94
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-accessible API requires only low-privilege auth (reader role suffices); crash causes complete server unavailability with no confidentiality or integrity impact.
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
Lifecycle Timeline
2DescriptionCVE.org
Any authenticated Velociraptor user - including one holding only the readerrole - can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.
AnalysisAI
Denial of service in Velociraptor allows any authenticated user - including those holding only the read-only reader role - to immediately terminate the entire server process with a single API call. By invoking SetPassword with a username that does not exist, an attacker triggers a null pointer dereference (CWE-476) that crashes the process, rendering the DFIR platform completely unavailable. No public exploit has been identified at time of analysis, but the trivially low exploitation barrier - any valid credential suffices - makes this a credible insider or compromised-account threat in any environment where Velociraptor is operationally depended upon.
Technical ContextAI
Velociraptor (CPE: cpe:2.3:a:rapid7:velociraptor) is an open-source endpoint monitoring, digital forensics, and incident response platform developed by Rapid7, widely used by security operations teams for live response and threat hunting. The vulnerability resides in the SetPassword API function, which fails to validate whether a supplied username resolves to an existing user object before dereferencing the resulting pointer. When a non-existent username is supplied, the function encounters a null or nil pointer and proceeds to dereference it - the classic CWE-476 (NULL Pointer Dereference) pattern - causing an unhandled runtime fault that terminates the entire server process. The CVSS vector AV:N/AC:L/PR:L confirms the endpoint is network-accessible and requires only low-privilege authentication, and the explicit mention of the reader role in the description confirms no elevated permissions are needed to reach the vulnerable code path.
RemediationAI
Consult the Rapid7 Velociraptor advisory at http://docs.velociraptor.app/announcements/advisories/cve-2026-18638/ and apply the vendor-released patch; no specific fixed version number was confirmed in the available intelligence data, so the advisory is the authoritative source for the exact patched release. As compensating controls until patching is completed, restrict Velociraptor account provisioning to only operationally necessary personnel and immediately revoke unused or dormant reader-role accounts, since any valid credential is sufficient to exploit this issue. Additionally, enforce network-level access controls - such as firewall rules or VPN requirements - to limit which hosts can reach the Velociraptor server API, accepting the trade-off of reduced remote analyst accessibility. Audit all existing accounts with the reader role to identify over-provisioned or stale credentials that represent latent exploitation vectors.
More in Velociraptor
View allPrivilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIEN
Directory traversal in Rapid7 Velociraptor servers running on Linux before 0.75.6 lets a rogue enrolled client upload a
Privilege escalation in Rapid7 Velociraptor lets any user permitted to schedule client monitoring artifacts run otherwis
Privilege escalation in Rapid7 Velociraptor allows an authenticated user holding only the 'investigator' role to execute
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-pr
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8),
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious me
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, e
Multi-tenancy authorization bypass in Velociraptor before 0.76.3 allows authenticated GUI users to execute VQL queries a
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today