EUVD-2026-56185
GHSA-79v4-qf48-mh94
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-accessible API requires only low-privilege auth (reader role suffices); crash causes complete server unavailability with no confidentiality or integrity impact.
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
Any authenticated Velociraptor user - including one holding only the readerrole - can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.
AnalysisAI
Denial of service in Velociraptor allows any authenticated user - including those holding only the read-only reader role - to immediately terminate the entire server process with a single API call. By invoking SetPassword with a username that does not exist, an attacker triggers a null pointer dereference (CWE-476) that crashes the process, rendering the DFIR platform completely unavailable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Velociraptor account at any privilege level, explicitly including the lowest-privilege reader role - no administrative, operator, or elevated permissions are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately captures the core impact: complete server availability loss achievable over the network with minimal authentication and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding any Velociraptor credential - including a dormant read-only analyst account obtained via phishing or credential reuse - sends a single SetPassword API request specifying a username string that does not correspond to any existing user in the system. The server dereferences a null pointer during username resolution, triggering an immediate process crash and complete platform outage with no further attacker interaction required. … |
| Remediation | Consult the Rapid7 Velociraptor advisory at http://docs.velociraptor.app/announcements/advisories/cve-2026-18638/ and apply the vendor-released patch; no specific fixed version number was confirmed in the available intelligence data, so the advisory is the authoritative source for the exact patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Velociraptor
View allPrivilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIEN
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-pr
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8),
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious me
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, e
We need to produce a JSON object with all specified fields, based on provided data. The CVE is CVE-2026-6290, about Velo
Cross-organization ACL disclosure in Velocidex Velociraptor before 0.76.5 allows any authenticated low-privilege user to
Account takeover in Rapid7 Velociraptor is possible when the platform is configured to use an external OIDC Identity Pro
Out-of-bounds read and memory exhaustion flaws in Velociraptor's NTFS parsing library allow denial of service when proce
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Null Pointer Dereference
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today