CVE-2026-18348CWE-863broken-access-control

CVE-2026-18348

Medium · published August 11, 2026

CVSS v3.1
4.1
EPSS
0%
Percentile
25.9
In the wild
Unconfirmed
What it is

Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00337 · 25.9th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-11T10:17Z
References (2)
http://docs.velociraptor.app/announcements/advisories/cve-2026-18348/ · [email protected]https://github.com/Velocidex/velociraptor/commit/48824fb51a2bdba832abc281e719ecbed74736df · [email protected]
EPSS history
Timeline
  • 11 AUG 05:37Z
    Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins
    cvelistv5