EUVD-2026-55961
GHSA-qx94-26r3-gv6g
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Analyst is a low-privilege authenticated role (not admin), so PR:L is more accurate; S:C and C:L reflect the server-side outbound network oracle reaching beyond the vulnerable component.
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.
AnalysisAI
Missing NETWORK ACL enforcement across Velociraptor's upload_azure, upload_sftp, upload_smb, upload_gcs, and related VQL plugins allows an authenticated analyst-role user to force the server to initiate outbound TCP connections to arbitrary attacker-controlled endpoints. This bypasses the intended NETWORK ACL permission boundary - a role separation control designed to prevent analysts from triggering server-side network activity - enabling port-oracle-based reconnaissance of the server's internal network segments and potential data exfiltration to external destinations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Velociraptor account with at minimum analyst-role privileges - the CVSS vector PR:H confirms that elevated authentication is required, and unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.1 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N reflects a medium-low severity, though the scope change (S:C) is a meaningful signal that impact extends beyond the Velociraptor process itself to the broader network environment accessible from the server. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An analyst-role Velociraptor user crafts a VQL query invoking upload_sftp or upload_azure with a target host and port under the attacker's control, causing the Velociraptor server to initiate outbound TCP connections to arbitrary internal or external IP:port combinations. By iterating over internal RFC-1918 addresses and observing connection success or timeout responses, the attacker maps reachable hosts and open ports from the server's privileged network vantage point - a segment potentially inaccessible from the analyst's own workstation. … |
| Remediation | The upstream fix is available in commit 48824fb51a2bdba832abc281e719ecbed74736df on the Velocidex/velociraptor GitHub repository; however, a specific tagged release version containing this fix has not been independently confirmed from available data - operators should consult the vendor advisory at http://docs.velociraptor.app/announcements/advisories/cve-2026-18348/ to identify the patched release version and upgrade to it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Velociraptor
View allPrivilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIEN
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-pr
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8),
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious me
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, e
We need to produce a JSON object with all specified fields, based on provided data. The CVE is CVE-2026-6290, about Velo
Cross-organization ACL disclosure in Velocidex Velociraptor before 0.76.5 allows any authenticated low-privilege user to
Account takeover in Rapid7 Velociraptor is possible when the platform is configured to use an external OIDC Identity Pro
Out-of-bounds read and memory exhaustion flaws in Velociraptor's NTFS parsing library allow denial of service when proce
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today