CVE-2026-18635 in Velociraptor
Summary
by MITRE • 08/11/2026
Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller's org instead of against the target org.
This allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability described represents a critical privilege escalation flaw in Velociraptor's query execution framework that stems from improper access control validation during cross-organization user impersonation operations. This security weakness affects versions prior to 0.77.2 and fundamentally undermines the multi-tenant security model that Velociraptor implements to isolate organizational data and administrative privileges. The vulnerability manifests through the query() plugin which is designed to execute VQL queries under different user contexts, a functionality essential for legitimate cross-organizational operations but critically misconfigured in its permission validation mechanism.
The technical flaw occurs at the core authorization logic where the system fails to properly validate permissions against the target organization rather than the calling user's organization. This misconfiguration creates an authorization bypass that allows malicious actors with administrative privileges in one organization to escalate their access rights and impersonate users within other organizations where they would normally lack the necessary IMPERSONATE permission. The vulnerability essentially creates a path for privilege escalation that circumvents the intended security boundaries between different organizational domains within the same Velociraptor instance.
The operational impact of this vulnerability is severe as it enables attackers to potentially gain unauthorized access to sensitive data and operations across multiple organizations within a single Velociraptor deployment. An administrator from one organization could leverage this flaw to execute queries as users in other organizations, potentially accessing confidential forensic data, system configurations, or administrative controls that should remain isolated. This cross-organizational privilege escalation capability undermines the fundamental security assumptions of multi-tenant environments and could result in widespread data exposure or system compromise across an enterprise's digital infrastructure.
This vulnerability aligns with CWE-284 which addresses improper access control and represents a classic case of insufficient authorization validation. The flaw also maps to ATT&CK technique T1548.005 which covers abuse of least privilege permissions, as the vulnerability allows for unauthorized elevation of privileges through improper permission checking. Organizations using Velociraptor in multi-tenant environments should urgently implement the patch released in version 0.77.2 which corrects the permission validation logic to properly evaluate IMPERSONATE permissions against the target organization rather than the calling user's organization. Additionally, security teams should conduct thorough audits of cross-organizational access patterns and implement monitoring for suspicious impersonation activities that might indicate exploitation attempts.
The remediation approach requires immediate deployment of Velociraptor version 0.77.2 or later, which implements proper cross-organization permission validation. Organizations should also review their existing organizational access controls and consider implementing additional monitoring solutions to detect unauthorized impersonation attempts. Security configurations should be audited to ensure that administrative privileges are appropriately scoped to individual organizations rather than allowing broad cross-organizational access. This vulnerability demonstrates the critical importance of proper authorization validation in multi-tenant systems and serves as a reminder of the potential for privilege escalation when access control mechanisms fail to properly validate permissions against the correct organizational context.