CVE-2026-18348

Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins

4.1 Medium

Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.34%Up 0.1 points since Aug 11, 2026

What each source reports

CVE List Score used 4.1

Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins

Record: CVE-2026-18348
CVSS 3.1: 4.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Weakness: CWE-863
Updated: 2026-11-02

EUVDEUVD-2026-55961 4.1

Record: EUVD-2026-55961
CVSS 3.1: 4.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-qx94-26r3-gv6g 4.1

Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows...

Record: GHSA-qx94-26r3-gv6g
CVSS 3.1: 4.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Weakness: CWE-863
Updated: 2026-11-02

NVD 4.1

Record: CVE-2026-18348
CVSS 3.1: 4.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Weakness: CWE-863
Updated: 2026-11-02

OSV 4.1

Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins

Record: CVE-2026-18348
CVSS 3.1: 4.1 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Weakness: CWE-863
Updated: 2026-11-02

OSVopenSUSE-SU-2026:12070-1 No score

velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media

These are all security issues fixed in the velociraptor-0.76.7.0.git145.b60ef1146-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:12070-1
Updated: 2026-11-02

Affected products

rapid7 velociraptor

Affected packages

Affected packages
Package	Affected	Fixed
`velociraptor` openSUSE:Tumbleweed From an advisory covering 40 CVEs	before 0.76.7.0.git145.b60ef1146-1.1	0.76.7.0.git145.b60ef1146-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-18348 is a medium vulnerability (CVSS 4.1) in Rapid7 Velociraptor, published August 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. No source names a fixed version.

References

Show 40 moreShow less