CVE-2026-18636

The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to access usually denied files. If the user has read permission in the ROOT org, this allows access to other orgs, in which the user may not have permission.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
http://docs.velociraptor.app/announcements/advisories/cve-2026-18636/

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) La API gRPC de Velociraptor tiene un endpoint VFSGetBuffer que permite leer archivos del almacén de datos. Para evitar que los usuarios lean archivos sensibles o accedan a otras organizaciones, se verifica el prefijo de la ruta solicitada contra una lista de prefijos denegados. Esta verificación de prefijo puede ser eludida, permitiendo a un usuario acceder a archivos normalmente denegados. Si el usuario tiene permiso de lectura en la organización ROOT, esto permite el acceso a otras organizaciones en las que el usuario podría no tener permiso.

Information

Published : 2026-08-11 15:17

Updated : 2026-10-23 19:10

NVD link : CVE-2026-18636

Mitre link : CVE-2026-18636

CVE.ORG link : CVE-2026-18636

JSON object : View

Products Affected

No product.

CWE

CWE-288

Authentication Bypass Using an Alternate Path or Channel

{"id": "CVE-2026-18636", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18636", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T19:25:52.804927Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@rapid7.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "cve@rapid7.com", "affectedData": [{"repo": "https://github.com/Velocidex/velociraptor/", "vendor": "Rapid7", "product": "Velociraptor", "versions": [{"status": "affected", "version": "0", "lessThan": "0.77.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T15:17:28.760", "references": [{"url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-18636/", "source": "cve@rapid7.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@rapid7.com", "description": [{"lang": "en", "value": "CWE-288"}]}], "descriptions": [{"lang": "en", "value": "The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to access usually denied files. If the user has read permission in the ROOT org, this allows access to other orgs, in which the user may not have permission."}, {"lang": "es", "value": "La API gRPC de Velociraptor tiene un endpoint VFSGetBuffer que permite leer archivos del almac\u00e9n de datos. Para evitar que los usuarios lean archivos sensibles o accedan a otras organizaciones, se verifica el prefijo de la ruta solicitada contra una lista de prefijos denegados. Esta verificaci\u00f3n de prefijo puede ser eludida, permitiendo a un usuario acceder a archivos normalmente denegados. Si el usuario tiene permiso de lectura en la organizaci\u00f3n ROOT, esto permite el acceso a otras organizaciones en las que el usuario podr\u00eda no tener permiso."}], "lastModified": "2026-10-23T19:10:00.167", "sourceIdentifier": "cve@rapid7.com"}