CVE-2026-18636: Velociraptor gRPC API Auth Bypass Flaw

CVE-2026-18636 Overview

CVE-2026-18636 is an authorization bypass vulnerability in the Velociraptor digital forensics and incident response platform. The flaw resides in the VFSGetBuffer endpoint of the Velociraptor gRPC API, which reads files from the datastore. Velociraptor enforces access boundaries by comparing requested paths against a list of denied prefixes. Attackers can bypass this prefix check to access files that should be restricted. When the requesting user holds read permission in the ROOT org, the bypass enables cross-org access to data the user is not authorized to view. The issue is tracked under CWE-288: Authentication Bypass Using an Alternate Path or Channel.

Critical Impact
Authenticated users with read permission in the ROOT org can bypass the datastore prefix filter to read sensitive files and access data belonging to other Velociraptor orgs.

Affected Products

Velociraptor digital forensics and incident response platform
Velociraptor gRPC API VFSGetBuffer endpoint
Multi-org Velociraptor deployments where users hold ROOT org read permission

Discovery Timeline

2026-08-11 - CVE-2026-18636 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-18636

Vulnerability Analysis

Velociraptor exposes a gRPC API endpoint named VFSGetBuffer that returns file contents from the server datastore. The datastore holds artifact collections, client metadata, and org-scoped configuration. To enforce tenant isolation and protect sensitive files, the endpoint checks each requested path against a denylist of restricted prefixes before returning data.

The prefix comparison logic does not fully normalize the requested path before evaluation. A caller can construct a path that resolves to a denied location but does not match the denylist string comparison. The request then passes the authorization check and the file is returned.

Velociraptor supports multi-tenant deployments through the concept of orgs, and users are typically scoped to a single org. When a user has read access in the ROOT org, the prefix bypass extends into datastore locations that belong to other orgs. This breaks the tenancy boundary that customers rely on for investigative isolation. See the Velociraptor Security Advisory for vendor detail.

Root Cause

The root cause is incomplete input canonicalization in the VFSGetBuffer authorization path. The denied-prefix check operates on the raw requested path rather than a normalized form, allowing crafted inputs to evade the denylist while still resolving to a restricted datastore location. This pattern maps to [CWE-288].

Attack Vector

Exploitation requires an authenticated gRPC API user with read permission. The attacker crafts a VFSGetBuffer request whose path bypasses the prefix denylist and points to a sensitive datastore file or another org's datastore tree. No user interaction is required, and the request is issued over the network to the Velociraptor API endpoint.

Refer to the Velociraptor Security Advisory CVE-2026-18636 for technical guidance from the vendor. No public proof-of-concept exploit is currently referenced in the CVE record.

Detection Methods for CVE-2026-18636

Indicators of Compromise

Unexpected VFSGetBuffer gRPC calls originating from accounts scoped to the ROOT org that reference datastore paths outside their normal usage pattern.
API request paths containing unusual traversal sequences, mixed separators, or encoded characters that resolve to denied prefixes after normalization.
Access to datastore files belonging to orgs the calling user is not a member of.

Detection Strategies

Enable and centralize Velociraptor audit logging for gRPC API calls, and alert on VFSGetBuffer calls that reference paths outside the caller's assigned org.
Baseline normal API access patterns per user, then flag deviations such as sudden reads of configuration files or cross-org datastore paths.
Correlate authentication events with gRPC API access to identify low-privilege ROOT org accounts issuing broad VFSGetBuffer requests.

Monitoring Recommendations

Forward Velociraptor server logs and gRPC audit records to a centralized SIEM for retention and query.
Monitor for repeated VFSGetBuffer failures followed by successes, which can indicate probing for the bypass condition.
Review ROOT org membership regularly and reduce the number of accounts that hold read permission there.

How to Mitigate CVE-2026-18636

Immediate Actions Required

Upgrade Velociraptor to the fixed release identified in the vendor advisory.
Audit all accounts that hold read permission in the ROOT org and remove any that do not require it.
Rotate credentials, API tokens, and any secrets that may have been stored in datastore locations exposed by the bypass.

Patch Information

Apply the patched Velociraptor build referenced in the vendor security advisory. The advisory documents affected versions and the fixed release that corrects the prefix normalization logic in the VFSGetBuffer endpoint.

Workarounds

Restrict network access to the Velociraptor gRPC API to trusted operator hosts using firewall rules or network policies.
Minimize ROOT org membership and enforce the principle of least privilege for API-capable accounts.
Enable verbose audit logging for the gRPC API to increase the likelihood of detecting exploitation attempts until the patch is applied.

bash

# Example: restrict Velociraptor gRPC API to a trusted management subnet
# Adjust interface, port, and CIDR to match your deployment
iptables -A INPUT -p tcp --dport 8001 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8001 -j DROP