CVE-2026-18348

MEDIUM

Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-18348 has a selected CVSS score of 4.1 (medium).

Description

Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 11, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Velociraptor

Browse Rapid7 / Velociraptor

Default status: unaffected

CVE ListBefore 0.77.2affected

References

3