CVE-2026-18636 in Velociraptor
Summary
by MITRE • 08/11/2026
The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to access usually denied files. If the user has read permission in the ROOT org, this allows access to other orgs, in which the user may not have permission.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability resides within the Velociraptor gRPC API implementation where the VFSGetBuffer endpoint is designed to retrieve file content from the datastore while enforcing security controls through prefix checking against a list of denied prefixes. This security mechanism intends to prevent unauthorized access to sensitive system files and cross-organizational data by validating that requested paths do not begin with restricted directories or patterns. However, the implementation contains a critical flaw in the prefix validation logic that allows attackers to bypass these protective measures through crafted path inputs that exploit ambiguities in the comparison algorithm.
The technical exploitation occurs when an attacker constructs a file path that appears to comply with the denied prefixes check but actually circumvents it due to insufficient validation of path normalization or string comparison methods. This vulnerability enables privilege escalation where users who possess read permissions within the ROOT organization can access data from other organizations they should not normally be able to reach. The flaw essentially creates a lateral movement vector that undermines the intended organizational boundaries and data isolation mechanisms within the Velociraptor platform.
The operational impact of this vulnerability is significant as it compromises the fundamental security model of multi-tenant environments where different organizations should maintain complete data separation. An attacker with minimal privileges can potentially access confidential forensic data, system configurations, or other sensitive information belonging to other organizations using the same Velociraptor instance. This breach affects both data confidentiality and organizational integrity, particularly in environments where multiple customers or departments share the same platform infrastructure.
The vulnerability maps to CWE-22 Improper Limitation of a Pathname to a Known Directory and aligns with ATT&CK technique T1078 Valid Accounts for lateral movement and privilege escalation. Organizations should implement immediate mitigations including strengthening path validation logic to ensure comprehensive prefix checking, implementing additional authorization controls beyond simple prefix matching, and establishing proper access controls that enforce organizational boundaries at multiple layers of the system architecture. The fix requires robust input sanitization and thorough testing of all path validation scenarios to prevent similar bypasses in other API endpoints.
This issue highlights the critical importance of secure coding practices in multi-tenant systems where inadequate input validation can lead to severe data exposure risks. The vulnerability demonstrates how seemingly simple security controls can be defeated through careful exploitation of implementation flaws, emphasizing the need for comprehensive security testing and defense-in-depth strategies. Organizations using Velociraptor should conduct immediate security assessments of their deployments to identify similar path traversal vulnerabilities in other API endpoints and ensure proper segregation of data between different organizational units within the platform.