CVE-2026-18638

Summary

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.

Affected Software

Weaknesses

• CWE-476: CWE-476 NULL pointer dereference
• CWE-703: CWE-703 Improper Check or Handling of Exceptional Conditions

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• http://docs.velociraptor.app/announcements/advisories/cve-2026-18638/

• ←Previous
• Next→