CVE-2026-18638

MEDIUM CVSS 6.5 View on NVD ↗

Description

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

http://docs.velociraptor.app/announcements/advisories/cve-2026-18638/

Published: Aug 11, 2026 16:17 UTC Modified: Aug 11, 2026 18:17 UTC