CVE-2026-18348: Velociraptor Auth Bypass Vulnerability

CVE-2026-18348 Overview

CVE-2026-18348 is a missing authorization vulnerability in Velociraptor, an open-source endpoint monitoring and digital forensics platform. The flaw affects the upload_azure, upload_sftp, and upload_smb VQL plugins, which do not enforce the NETWORK Access Control List (ACL) permission before initiating outbound connections. An authenticated user holding the analyst role can direct the Velociraptor server to connect to attacker-controlled endpoints. This bypasses the intended network permission boundary and enables internal reconnaissance through port-oracle behavior and data exfiltration to external hosts. The issue is tracked under CWE-863: Incorrect Authorization.

Critical Impact
Analyst-role users can pivot the Velociraptor server into internal networks and exfiltrate data over SMB, SFTP, or Azure Blob endpoints, bypassing the NETWORK ACL boundary.

Affected Products

Velociraptor server builds prior to the fix in commit 48824fb51a2bdba832abc281e719ecbed74736df
Velociraptor VQL upload_smb plugin (SMB accessor)
Velociraptor VQL upload_sftp and upload_azure plugins

Discovery Timeline

2026-08-11 - CVE-2026-18348 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-18348

Vulnerability Analysis

Velociraptor uses a role-based ACL model where sensitive operations require explicit permissions. The NETWORK ACL governs whether a VQL query can trigger outbound connections from the server. The upload_azure, upload_sftp, and upload_smb plugins invoke their respective accessors and initiate socket connections without first calling vql_subsystem.CheckAccess(scope, acls.NETWORK). An analyst-role user, who is not intended to have network egress rights, can therefore submit VQL that instructs the server to connect to arbitrary hosts and ports. The connection outcome (success, timeout, refusal) leaks information about internal services, producing a port oracle across the server's reachable network segments.

Root Cause

The root cause is a missing authorization check [CWE-863] in the SMB, SSH, and Azure upload code paths. The accessors constructed sessions and dialed remote endpoints before consulting the ACL subsystem. Because the NETWORK permission is not part of the default analyst role, the plugins effectively granted an implicit capability that the ACL model was designed to prevent.

Attack Vector

Exploitation requires authenticated access with the analyst role and network reachability to the Velociraptor GUI or API. The attacker submits a VQL query that calls one of the affected upload plugins with an attacker-controlled destination. The server initiates the outbound connection, allowing internal reconnaissance and exfiltration of files retrievable within the analyst's data scope.

// Patch: accessors/smb/smb.go — adds NETWORK ACL check before dialing SMB
func (self *SMBFileSystemAccessor) getSession(full_path *accessors.OSPath) (
	*smb2.Session, func(), error) {

	err := vql_subsystem.CheckAccess(self.scope, acls.NETWORK)
	if err != nil {
		return nil, nil, err
	}

	if len(full_path.Components) == 0 {
		return nil, nil, errors.New("First path component for smb accessor must be a server name or IP")
	}
}
// Source: https://github.com/Velocidex/velociraptor/commit/48824fb51a2bdba832abc281e719ecbed74736df

// Patch: accessors/ssh/session.go — imports acls package to enforce NETWORK permission on SFTP sessions
	"fmt"

	"golang.org/x/crypto/ssh"
	"www.velocidex.com/golang/velociraptor/acls"
	"www.velocidex.com/golang/velociraptor/constants"
	"www.velocidex.com/golang/velociraptor/services"
	"www.velocidex.com/golang/velociraptor/utils"
// Source: https://github.com/Velocidex/velociraptor/commit/48824fb51a2bdba832abc281e719ecbed74736df

Detection Methods for CVE-2026-18348

Indicators of Compromise

Velociraptor audit log entries showing VQL calls to upload_smb, upload_sftp, or upload_azure from analyst-role users.
Unexpected outbound TCP connections from the Velociraptor server to internal RFC1918 hosts on ports 445, 22, or to Azure Blob endpoints.
Repeated short-lived connections from the server to varying internal IPs and ports, indicative of port scanning through the upload plugins.

Detection Strategies

Review the Velociraptor server query log for VQL artifacts referencing the three affected plugins and correlate the caller role against the NETWORK ACL grant.
Alert on egress from the Velociraptor server to destinations outside the approved forensic upload allowlist.
Baseline normal SMB and SFTP destinations used by Velociraptor collections, then flag deviations.

Monitoring Recommendations

Enable and centralize Velociraptor audit logging, including query text, user identity, and role.
Instrument host-level firewall or eBPF telemetry on the Velociraptor server to capture outbound connection metadata.
Monitor role assignments and periodically export the ACL configuration to detect drift.

How to Mitigate CVE-2026-18348

Immediate Actions Required

Upgrade the Velociraptor server to a build that includes commit 48824fb51a2bdba832abc281e719ecbed74736df or later.
Audit accounts with the analyst role and remove unnecessary privileges until the patch is applied.
Review historical query logs for prior use of upload_smb, upload_sftp, or upload_azure by non-administrator users.

Patch Information

The fix adds explicit vql_subsystem.CheckAccess(scope, acls.NETWORK) calls in the SMB, SSH/SFTP, and Azure accessors so that the NETWORK permission is required before any outbound connection is dialed. See the Velociraptor Security Advisory CVE-2026-18348 and the GitHub commit 48824fb for the full change set.

Workarounds

Restrict use of the analyst role and require the administrator role for any workflow that legitimately needs the affected upload plugins.
Place the Velociraptor server behind an egress firewall that only permits connections to approved SMB, SFTP, and Azure Blob destinations.
Disable or block the upload_smb, upload_sftp, and upload_azure artifacts in server configuration until the update is deployed.

bash

# Example egress restriction using iptables on the Velociraptor server
# Allow only approved SFTP upload destination; drop other outbound SMB/SSH
iptables -A OUTPUT -p tcp -d 10.10.20.15 --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 22 -j DROP
iptables -A OUTPUT -p tcp --dport 445 -j DROP