Unauthorized Server Termination Vulnerability in Velociraptor by Velociraptor Team
CVE-2026-18638

6.5MEDIUM

Key Information:

Vendor

Rapid7

Status
Velociraptor
Vendor
CVE Published:
11 August 2026

What is CVE-2026-18638?

An issue exists in Velociraptor where any authenticated user, even those with minimal permissions such as 'reader,' can exploit a flaw in the SetPassword method. By sending a request with a nonexistent username, these users can unintentionally or maliciously terminate the entire server process. This poses a significant risk to server stability and availability.

Affected Version(s)

Velociraptor 0 < 0.77.2

References

http://docs.velociraptor.app/announcements/advisories/cve...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mayank Rajput (https://github.com/hackelite01)
.