CVE-2026-18348

Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.

CVSS v3 4.1 MEDIUM

4.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
http://docs.velociraptor.app/announcements/advisories/cve-2026-18348/
https://github.com/Velocidex/velociraptor/commit/48824fb51a2bdba832abc281e719ecbed74736df

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Falta de verificación de autorización en los plugins VQL upload_azure, upload_sftp y upload_smb permite que un usuario autenticado con rol de analista pueda iniciar conexiones de red salientes controladas por el atacante desde el servidor Velociraptor, eludiendo el límite de permisos de la ACL DE RED. Esto permite el reconocimiento de red interno a través de oráculo de puerto y la posible exfiltración de datos a puntos finales externos.

Information

Published : 2026-08-11 06:17

Updated : 2026-10-23 19:10

NVD link : CVE-2026-18348

Mitre link : CVE-2026-18348

CVE.ORG link : CVE-2026-18348

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-18348", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18348", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T14:21:58.567744Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@rapid7.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.3}]}, "affected": [{"source": "cve@rapid7.com", "affectedData": [{"repo": "https://github.com/Velocidex/velociraptor/", "vendor": "Rapid7", "product": "Velociraptor", "versions": [{"status": "affected", "version": "0", "lessThan": "0.77.2", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "Velociraptor", "defaultStatus": "unaffected"}]}], "published": "2026-08-11T06:17:13.287", "references": [{"url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-18348/", "source": "cve@rapid7.com"}, {"url": "https://github.com/Velocidex/velociraptor/commit/48824fb51a2bdba832abc281e719ecbed74736df", "source": "cve@rapid7.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@rapid7.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints."}, {"lang": "es", "value": "Falta de verificaci\u00f3n de autorizaci\u00f3n en los plugins VQL upload_azure, upload_sftp y upload_smb permite que un usuario autenticado con rol de analista pueda iniciar conexiones de red salientes controladas por el atacante desde el servidor Velociraptor, eludiendo el l\u00edmite de permisos de la ACL DE RED. Esto permite el reconocimiento de red interno a trav\u00e9s de or\u00e1culo de puerto y la posible exfiltraci\u00f3n de datos a puntos finales externos."}], "lastModified": "2026-10-23T19:10:00.167", "sourceIdentifier": "cve@rapid7.com"}