CVE-2026-18638 in Velociraptor
Summary
by MITRE • 08/11/2026
Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical privilege escalation and denial of service flaw within the Velociraptor security platform that affects authenticated users regardless of their role permissions. The issue stems from improper input validation and error handling in the SetPassword API endpoint where the system fails to properly validate user existence before attempting password modification operations. When an authenticated user submits a SetPassword request with a non-existent username, the underlying system processes this request without adequate safeguards, leading to a complete server termination event that can be triggered by any user with even minimal read permissions.
The technical implementation flaw resides in the server-side processing logic that does not perform proper authentication checks or access control validation before executing destructive operations. This vulnerability operates under the Common Weakness Enumeration category of insufficient input validation and can be classified as CWE-20, which encompasses issues related to improper input validation allowing for command injection or process manipulation attacks. The root cause demonstrates a failure in implementing proper defensive programming practices where the system does not distinguish between legitimate user operations and potentially malicious attempts to exploit API endpoints.
From an operational perspective this vulnerability creates severe impact conditions where any authenticated user can execute a remote code execution attack resulting in complete server compromise. The ATT&CK framework classification would place this under T1059 for command and scripting interpreter and potentially T1499 for endpoint denial of service, as the attacker can effectively shut down the entire security monitoring platform. This vulnerability essentially provides an unprivileged user with the ability to perform privilege escalation through destructive means, as the system's response to invalid user requests triggers a cascading failure that terminates all server processes.
The attack vector is particularly concerning because it requires no special privileges beyond basic authentication, making it accessible to anyone who can establish a session with the Velociraptor instance. The exploit involves sending a single API request to the SetPassword endpoint with a non-existent username parameter, which then causes the server to crash and restart, effectively creating a denial of service condition that can be repeated at will. Organizations relying on Velociraptor for security monitoring and incident response operations face significant risk as this vulnerability could be exploited by malicious actors to disrupt critical security infrastructure, potentially masking their actual intrusion activities while simultaneously disabling monitoring capabilities.
Mitigation strategies must include immediate implementation of input validation controls that verify user existence before processing password modification requests, along with proper error handling that prevents destructive server responses to malformed inputs. Security teams should implement rate limiting and logging mechanisms around authentication endpoints to detect anomalous usage patterns that might indicate exploitation attempts. Additionally, network segmentation and access controls should be applied to limit direct exposure of Velociraptor APIs to untrusted networks while ensuring that only authorized personnel have access to administrative functions. The remediation approach should follow principle of least privilege implementations where even authenticated users cannot perform operations outside their designated permissions, and all API endpoints should undergo comprehensive security testing including fuzzing and penetration testing to identify similar validation flaws.