CVE-2026-18348

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18348", "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "state": "PUBLISHED", "assignerShortName": "rapid7", "dateReserved": "2026-07-30T04:46:15.496Z", "datePublished": "2026-08-11T05:37:11.333Z", "dateUpdated": "2026-08-11T14:22:11.191Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7", "dateUpdated": "2026-08-11T05:37:11.333Z"}, "title": "Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "affected": [{"vendor": "Rapid7", "product": "Velociraptor", "platforms": ["Linux"], "packageName": "Velociraptor", "repo": "https://github.com/Velocidex/velociraptor/", "versions": [{"status": "affected", "version": "0", "lessThan": "0.77.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><span>Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows a</span><span>n authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.</span></div>"}]}], "references": [{"url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-18348/"}, {"url": "https://github.com/Velocidex/velociraptor/commit/48824fb51a2bdba832abc281e719ecbed74736df"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N"}}], "credits": [{"lang": "en", "value": "Hamad Alghamdi", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T14:21:58.567744Z", "id": "CVE-2026-18348", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T14:22:11.191Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18348", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T14:21:58.567744Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T14:22:05.624Z"}}], "cna": {"title": "Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Hamad Alghamdi"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/Velocidex/velociraptor/", "vendor": "Rapid7", "product": "Velociraptor", "versions": [{"status": "affected", "version": "0", "lessThan": "0.77.2", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "Velociraptor", "defaultStatus": "unaffected"}], "references": [{"url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-18348/"}, {"url": "https://github.com/Velocidex/velociraptor/commit/48824fb51a2bdba832abc281e719ecbed74736df"}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.", "supportingMedia": [{"type": "text/html", "value": "<div><span>Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows a</span><span>n authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.</span></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7", "dateUpdated": "2026-08-11T05:37:11.333Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18348", "state": "PUBLISHED", "dateUpdated": "2026-08-11T14:22:11.191Z", "dateReserved": "2026-07-30T04:46:15.496Z", "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "datePublished": "2026-08-11T05:37:11.333Z", "assignerShortName": "rapid7"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "Velociraptor", "platforms": ["Linux"], "product": "Velociraptor", "repo": "https://github.com/Velocidex/velociraptor/", "vendor": "Rapid7", "versions": [{"lessThan": "0.77.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cve@rapid7.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints."}, {"lang": "es", "value": "Falta de verificaci\u00f3n de autorizaci\u00f3n en los plugins VQL upload_azure, upload_sftp y upload_smb permite que un usuario autenticado con rol de analista pueda iniciar conexiones de red salientes controladas por el atacante desde el servidor Velociraptor, eludiendo el l\u00edmite de permisos de la ACL DE RED. Esto permite el reconocimiento de red interno a trav\u00e9s de or\u00e1culo de puerto y la posible exfiltraci\u00f3n de datos a puntos finales externos."}], "id": "CVE-2026-18348", "lastModified": "2026-10-23T19:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 1.4, "source": "cve@rapid7.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18348", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T14:21:58.567744Z", "version": "2.0.3"}}]}, "published": "2026-08-11T06:17:13.287", "references": [{"source": "cve@rapid7.com", "url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-18348/"}, {"source": "cve@rapid7.com", "url": "https://github.com/Velocidex/velociraptor/commit/48824fb51a2bdba832abc281e719ecbed74736df"}], "sourceIdentifier": "cve@rapid7.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "cve@rapid7.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.77.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Velociraptor", "source": "cna", "vendor": "Rapid7"}, "product": "velociraptor", "vendor": "rapid7"}], "created": "2026-08-11T07:30:03.126545+00:00", "updated": "2026-08-11T07:30:03.312211+00:00", "vendors": ["rapid7", "rapid7$PRODUCT$velociraptor"]}