EUVD-2026-56178
GHSA-96p2-wv27-6pfj
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Network-accessible gRPC API requires pre-existing ROOT org high-privilege credentials (PR:H, AV:N, AC:L); scope changes across org boundaries (S:C) with purely read-only cross-tenant confidentiality impact (C:H, I:N, A:N).
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
Lifecycle Timeline
2DescriptionCVE.org
The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to access usually denied files. If the user has read permission in the ROOT org, this allows access to other orgs, in which the user may not have permission.
AnalysisAI
Cross-organizational data exfiltration in Rapid7 Velociraptor's gRPC API allows authenticated ROOT org users to read datastore files belonging to other tenant organizations by bypassing the VFSGetBuffer endpoint's path prefix deny-list. The bypass undermines Velociraptor's multi-tenant isolation model, exposing sensitive DFIR artifacts - forensic evidence, endpoint memory, and investigation files - from organizations the attacker is not authorized to access. No public exploit code has been identified at time of analysis, and exploitation requires pre-existing high-privilege credentials in the ROOT organization.
Technical ContextAI
Velociraptor is Rapid7's open-source Digital Forensics and Incident Response (DFIR) platform, which uses gRPC as its API transport layer. The VFSGetBuffer endpoint exposes read access to the Virtual File System (VFS) datastore, which stores collected forensic artifacts from monitored endpoints. To enforce multi-tenant isolation, the platform maintains a prefix deny-list that is checked against the requested datastore path. The root cause is CWE-288 (Authentication Bypass Using an Alternate Path or Channel) - the prefix-check logic can be circumvented, allowing crafted paths to resolve to restricted locations outside the caller's authorized scope. The CPE string cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:* indicates all versions are potentially affected. The CVSS scope change (S:C) directly reflects the cross-org boundary violation inherent to this flaw.
RemediationAI
Consult the Rapid7 Velociraptor advisory at http://docs.velociraptor.app/announcements/advisories/cve-2026-18636/ for the specific patched version - an exact fix version number is not independently confirmed from the available input data, so the vendor advisory is the authoritative source. As an interim compensating control, administrators should audit ROOT org membership and remove all non-essential user accounts from ROOT org read roles, since exploitation is gated entirely on holding those credentials. Network-level access controls restricting gRPC API exposure (default port 8001) to trusted administrative hosts reduce the attack surface for any credential-based API abuse, though this does not eliminate the vulnerability. In multi-tenant environments, treat any ROOT org account compromise as a full cross-tenant incident until a patch is applied, as the bypass grants read access to all org datastores.
More in Velociraptor
View allPrivilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIEN
Directory traversal in Rapid7 Velociraptor servers running on Linux before 0.75.6 lets a rogue enrolled client upload a
Privilege escalation in Rapid7 Velociraptor lets any user permitted to schedule client monitoring artifacts run otherwis
Privilege escalation in Rapid7 Velociraptor allows an authenticated user holding only the 'investigator' role to execute
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-pr
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8),
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious me
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, e
Multi-tenancy authorization bypass in Velociraptor before 0.76.3 allows authenticated GUI users to execute VQL queries a
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today