TL;DR: CVE-2026-18348 is an incorrect authorization vulnerability (CWE-863, CVSS 4.1) in Velociraptor, the open-source endpoint monitoring and digital forensics tool by Rapid7. Three VQL upload plugins (upload_azure, upload_sftp, and upload_smb) skip the NETWORK ACL permission check. An authenticated analyst-role user can initiate outbound network connections from the Velociraptor server to attacker-controlled endpoints, enabling internal network reconnaissance and data exfiltration. Fixed in version 0.77.2.

The ecosystem angle: why a security tool vulnerability is different

Velociraptor sits in a privileged position. It is a DFIR platform deployed across enterprise networks to collect forensic artifacts, query endpoints, and run incident response investigations. Security teams install agents on thousands of endpoints. The Velociraptor server is a central command node with network reach into those endpoints, and it holds sensitive investigation data. A vulnerability in a security tool is a force multiplier for attackers. They compromise the tool that defenders trust to find them.

Rapid7 maintains Velociraptor as open source on GitHub. Enterprise deployments use it alongside the Rapid7 Insight Platform, but the standalone open-source edition runs in security operations centers, incident response teams, and managed detection and response providers worldwide. The tool is designed for scale. A single server can manage thousands of endpoints. That makes any server-side authorization bypass worth attention even at a medium CVSS score.

What is broken

Velociraptor has a NETWORK ACL permission boundary. It controls which users can initiate outbound network connections from the server. The idea is that an analyst with limited permissions should not be able to use the server as a pivot point to reach internal systems or exfiltrate data to external hosts.

Three VQL plugins bypass this check entirely: upload_azure, upload_sftp, and upload_smb. Each of these plugins initiates an outbound network connection to upload collected data. None of them call the authorization function that the NETWORK ACL enforces. An authenticated user with the analyst role, a tier below administrator, can run a VQL query using any of these plugins to connect to an arbitrary destination.

The bypass enables two attack patterns:

• Port oracle reconnaissance: The attacker points an upload plugin at internal IP addresses and port combinations. By observing which connections succeed and which time out, they map the internal network topology from the Velociraptor server's vantage point.
• Data exfiltration: The attacker configures an upload destination to an external server they control. Forensic artifacts and collected data flow out of the enterprise network through a channel that looks like legitimate Velociraptor activity.

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N. The privileges-required is high because the attacker needs the analyst role, which tempers the practical exploitability. But the scope change matters. The permission boundary exists specifically to prevent this class of network access, and the plugins silently ignore it.

Who is affected

Any Velociraptor deployment running a version prior to 0.77.2 where analyst-role users have access to VQL queries is affected. The fix commit landed in the Velocidex/velociraptor repository and the 0.77.2 release includes the authorization check for all three upload plugins.

Deployments that restrict VQL query access to administrators only are at lower risk. The attack requires an authenticated session with the analyst role and the ability to run custom VQL.

What to do

Update to Velociraptor 0.77.2 immediately. This is a single binary update. Download the release for your platform:

# Linux amd64
wget https://github.com/Velocidex/velociraptor/releases/download/v0.77.2/velociraptor-v0.77.2-linux-amd64
chmod +x velociraptor-v0.77.2-linux-amd64
./velociraptor-v0.77.2-linux-amd64 frontend -v

Verify the change in your deployment:

• Confirm the server binary reports version 0.77.2 after restart.
• Audit analyst-role accounts. The exploit requires an authenticated analyst. Review who holds this role and whether they need VQL query execution access.
• Review server logs for outbound connections from upload_azure, upload_sftp, or upload_smb to destinations that do not match your expected upload infrastructure. The advisory page and fix commit are linked below.

The fix commit is 48824fb51a2bdba832abc281e719ecbed74736df on GitHub. The advisory is published at docs.velociraptor.app.

Why it matters

The CWE-863 classification tells the story: incorrect authorization. The NETWORK ACL was designed to be a permission boundary. Three plugins quietly sidestepped it. For a tool whose entire purpose is detecting and investigating security incidents, a broken authorization check in the investigation platform itself creates a blind spot. Defenders running compromised versions may not see the evidence of their own exfiltration in the logs they trust.

References

• NVD: CVE-2026-18348
• HOL Guard: CVE-2026-18348
• Velociraptor Advisory CVE-2026-18348
• Fix Commit on GitHub
• Velociraptor Repository