CVE-2026-18652 in Velociraptor
Summary
by MITRE • 08/12/2026
Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes.
In particular, a user with read access to the root org can access result sets from child orgs.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
This vulnerability exists within Velociraptor's multi-tenant architecture where suborganizations are stored within the datastore directory structure. The core issue stems from insufficient path validation in the graphical user interface component that handles stacked result set operations. When users interact with the GUI to retrieve result sets, the system fails to properly validate the requested file paths against a predefined deny list that should prevent access to restricted directories. This technical flaw creates a privilege escalation vector where users with read permissions at the root organizational level can bypass intended access controls and retrieve result sets from child organizations.
The vulnerability operates through a path traversal mechanism that allows unauthorized data access by exploiting the lack of proper prefix validation. Specifically, when the GUI requests result sets from the datastore, it does not sufficiently sanitize or validate the requested paths against the configured deny list that should restrict access to sensitive subdirectory structures. This allows a malicious actor with read privileges in the root organization to effectively traverse into child organization data stores and extract information that should remain isolated. The flaw represents a direct violation of the principle of least privilege and demonstrates inadequate input validation within the application's security controls.
The operational impact of this vulnerability extends beyond simple unauthorized data access, as it undermines the fundamental multi-tenant isolation guarantees that Velociraptor provides to its users. Organizations relying on Velociraptor for security monitoring and incident response may experience data leakage between different organizational units, potentially exposing sensitive forensic data or operational information from child organizations to unauthorized personnel. This breach of data separation could compromise ongoing investigations, violate privacy regulations, and expose confidential information that should remain compartmentalized within their respective organizational boundaries.
The vulnerability aligns with CWE-22 Path Traversal and CWE-73 Path Traversal in Directory Name, both of which address improper validation of file paths that can lead to unauthorized access to restricted directories. From an ATT&CK framework perspective, this represents a privilege escalation technique under T1068 Valid Accounts and T1566 Phishing, as it exploits legitimate user permissions to gain access to restricted resources. The recommended mitigations include implementing strict path validation routines that enforce the deny list restrictions at the GUI layer, adding additional authentication checks for cross-organization data access, and ensuring proper separation of concerns between different organizational units within the datastore structure. Organizations should also consider implementing more granular access controls and audit logging to detect unauthorized attempts to traverse organizational boundaries.