DeutschShown in its original language — a full translation is planned for a future version.
Rapid7 Velociraptor: Mehrere Schwachstellen
view advisory published 2026-08-10
Ein Angreifer kann mehrere Schwachstellen in Rapid7 Velociraptor ausnutzen, um erweiterte Berechtigungen, einschließlich Administratorrechte, zu erlangen, Sicherheitsmaßnahmen zu umgehen, Spoofing- und Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, sensible Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
01
describes (16)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-15371US | — | — | ||
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not li… | ||||
| CVE-2026-64955US | — | — | ||
When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution.
Velociraptor fails to sanitiz… | ||||
| CVE-2026-64952US | —OT elevated | — | ||
The hunt_delete() VQL function allows deleting hunts.
Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "investigator" role) ins… | ||||
| CVE-2026-64951US | — | — | ||
A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process.
The problem is… | ||||
| CVE-2026-18652US | —OT elevated | — | ||
Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is n… | ||||
| CVE-2026-64954US | —OT elevated | — | ||
Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is n… | ||||
| CVE-2026-18640US | — | — | ||
The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org's data s… | ||||
| CVE-2026-18639US | — | — | ||
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verifi… | ||||
| CVE-2026-18638US | — | — | ||
Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a usern… | ||||
| CVE-2026-18860US | — | — | ||
Velociraptor allows multi-tenant deployments named "Orgs".
By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment… | ||||
| CVE-2026-18636US | —OT elevated | — | ||
The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requ… | ||||
| CVE-2026-18635US | —OT elevated | — | ||
Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have t… | ||||
| CVE-2026-17535US | — | — | ||
Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images.
Typically Velociraptor's… | ||||
| CVE-2026-18972US | — | — | ||
An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack… | ||||
| CVE-2026-18348US | —OT elevated | — | ||
Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network… | ||||
| CVE-2026-64953US | — | — | ||
02
references
External citations — patches, advisories, analysis.
- Rapid7 Velociraptor Advisory vom 2026-08-10external
- Rapid7 Velociraptor Advisory vom 2026-08-10external
- Rapid7 Velociraptor Advisory vom 2026-08-10external
- Rapid7 Velociraptor Advisory vom 2026-08-10external
- Rapid7 Velociraptor Advisory vom 2026-08-10external
- Rapid7 Velociraptor Advisory vom 2026-08-10external
- Rapid7 Velociraptor Advisory vom 2026-08-10external
- Rapid7 Velociraptor Advisory vom 2026-08-10external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan