CVE-2026-18635: Velociraptor Auth Bypass Vulnerability

CVE-2026-18635 Overview

CVE-2026-18635 is an authorization flaw in Velociraptor, an open-source digital forensics and incident response (DFIR) platform. Velociraptor Query Language (VQL) provides a query() plugin that executes VQL statements in the context of a different organization or user. The plugin requires the caller to hold the IMPERSONATE permission, which is typically restricted to administrators. Velociraptor versions prior to 0.77.2 evaluate this permission against the caller's own organization rather than the target organization. An administrator in one org can therefore impersonate a user in another org where the administrator lacks IMPERSONATE rights. The issue is tracked under CWE-863: Incorrect Authorization.

Critical Impact
An administrator scoped to one Velociraptor organization can execute VQL queries as users in other organizations, breaking multi-tenant isolation and enabling unauthorized data access across tenants.

Affected Products

Velociraptor DFIR platform versions prior to 0.77.2
Multi-tenant Velociraptor deployments using organizations for tenant separation
Environments where administrative roles are delegated per organization

Discovery Timeline

2026-08-11 - CVE-2026-18635 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18635

Vulnerability Analysis

Velociraptor uses organizations (orgs) as tenant boundaries. Each org has its own users, clients, and role assignments. The VQL query() plugin lets a caller submit a query that executes under a different principal or org context, provided the caller carries the IMPERSONATE permission. This permission check is the sole gate protecting cross-context execution.

In versions before 0.77.2, the permission evaluation runs against the calling user's own org rather than the target org referenced in the impersonation request. A user who is an administrator in Org A and holds IMPERSONATE there can invoke query() targeting Org B. The check passes because it inspects Org A, even though the caller has no rights within Org B.

The resulting VQL runs with the impersonated user's privileges in Org B, exposing artifacts, collections, and client data from that tenant. In deployments that use orgs for regulatory or customer separation, this collapses the tenancy model.

Root Cause

The defect is an incorrect authorization scope [CWE-863]. The IMPERSONATE capability check binds to the caller's context instead of the target context. Authorization decisions must be evaluated against the resource being accessed, not the requester's home realm.

Attack Vector

Exploitation requires authenticated access with administrator-level privileges in at least one Velociraptor org. The attacker submits a VQL request that invokes the query() plugin with parameters specifying a different org and a target user in that org. The server accepts the request, and the query executes with the impersonated identity in the foreign org. See the Velociraptor Security Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-18635

Indicators of Compromise

VQL audit log entries showing query() plugin invocations that specify an org or runas parameter targeting an org different from the caller's home org
Query execution records attributed to users who did not authenticate during the same time window
Access to artifacts or client collections in an org from an administrator account that has no assigned role in that org

Detection Strategies

Review Velociraptor server audit logs for use of the query() plugin with cross-org impersonation parameters and correlate the caller's org with the target org
Baseline normal administrative activity per org and alert on deviations where an admin issues queries scoped to a foreign tenant
Compare user role assignments against actual VQL execution identities to surface impersonation events that bypass expected authorization

Monitoring Recommendations

Ship Velociraptor audit and query logs to a central SIEM or data lake and retain them for cross-tenant investigation
Enable alerting on any VQL statement that references the IMPERSONATE permission or the query() plugin with non-default org context
Track version inventory of Velociraptor servers to confirm all instances are running 0.77.2 or later

How to Mitigate CVE-2026-18635

Immediate Actions Required

Upgrade all Velociraptor servers to version 0.77.2 or later, which corrects the permission scope evaluation
Audit historical VQL logs for cross-org query() invocations since the multi-tenant configuration was introduced
Review and reduce the number of accounts holding the IMPERSONATE permission in any org

Patch Information

Velociraptor 0.77.2 addresses CVE-2026-18635 by evaluating the IMPERSONATE permission against the target org rather than the caller's org. Refer to the Velociraptor Security Advisory for release details and upgrade guidance.

Workarounds

Remove the IMPERSONATE permission from administrator roles in orgs where cross-tenant impersonation is not required until the patch is applied
Consolidate administrative accounts so that a single principal does not hold elevated privileges across multiple tenants
Restrict network access to the Velociraptor GUI and API to trusted operators pending upgrade

bash

# Verify installed Velociraptor version and upgrade if below 0.77.2
velociraptor version

# Example: list roles that grant IMPERSONATE to identify accounts to review
velociraptor --config server.config.yaml acl show <username>