CVE-2026-78412 in Velociraptor
Summary
by MITRE • 10/05/2026
Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have no access.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in Velociraptor involves a critical authorization bypass within the WatchEvent gRPC API, specifically concerning how organizational boundaries are enforced during event streaming operations. In multi-tenant environments where data isolation is paramount, systems must strictly adhere to the principle of least privilege and ensure that access control decisions are based on the intended target resource rather than merely the identity or default context of the requesting user. The flaw arises because the server-side implementation validates API permissions against the caller's current organizational unit instead of verifying whether the authenticated user possesses explicit rights for the specific Organization ID specified in the request parameters. This logical error creates a significant gap between authentication and authorization, allowing an attacker to bypass intended security controls by simply manipulating the OrgId field within their API requests.
From a technical perspective, this issue represents a classic case of insecure direct object reference or broken access control where the system fails to properly associate the user's permissions with the requested resource identifier. When a client initiates a stream for events belonging to Organization A while authenticated as a member of Organization B, the server incorrectly assumes that the permissions granted to Organization B are sufficient for accessing data in Organization A. This misalignment allows users who have been granted limited access within their own tenant context to escalate their privileges effectively by targeting resources outside their designated scope. The vulnerability is particularly dangerous because it affects real-time event streaming, which often contains sensitive telemetry, forensic artifacts, and operational logs that could reveal internal network structures, user activities, or security configurations if exposed to unauthorized parties.
The operational impact of this vulnerability is severe in any deployment utilizing Velociraptor for multi-tenant monitoring or incident response operations. Unauthorized access to events from other organizations can lead to the leakage of confidential information, including system logs, process execution details, and network traffic captures belonging to different tenants or departments. This breach of data isolation undermines trust in the platform's ability to secure sensitive environments and may violate regulatory compliance requirements such as GDPR, HIPAA, or SOC2 that mandate strict separation of customer data. Furthermore, an attacker could use this access to perform reconnaissance on other organizations within the same Velociraptor instance, identifying vulnerabilities, active users, or security tools deployed in those environments without detection by standard audit logs that might not flag cross-tenant API calls as anomalous if they appear technically valid from a session perspective.
To mitigate this risk, immediate remediation should focus on correcting the authorization logic within the WatchEvent gRPC handler to ensure that permission checks are performed against the requested OrgId rather than the caller's default organization context. Developers must implement explicit validation steps that verify whether the authenticated user has read permissions for the specific target organization before initiating any data stream. Additionally, implementing comprehensive audit logging for cross-tenant API calls can aid in detecting potential exploitation attempts and provide forensic evidence if a breach occurs. Long-term improvements should include adopting automated security testing frameworks that specifically test for broken access control scenarios involving multi-tenancy to ensure such logical flaws are caught during the development lifecycle rather than after deployment.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, as well as CWE-862, Missing Authorization, since the system fails to enforce proper authorization checks for the requested resource context. In terms of offensive security frameworks, this flaw facilitates techniques associated with MITRE ATT&CK T1078, Valid Accounts, by allowing an attacker to leverage legitimate credentials to access unauthorized resources through parameter manipulation. It also relates to T1530, Data from Information Repositories, as the exploited API serves as a conduit for exfiltrating structured data about other organizational units. Addressing this issue requires not only code correction but also a review of how multi-tenant isolation is architecturally enforced across all gRPC endpoints in the Velociraptor application to prevent similar logical errors elsewhere in the system.