CVE-2026-18638: Velociraptor DOS Vulnerability

CVE-2026-18638 Overview

CVE-2026-18638 is a denial-of-service vulnerability in Velociraptor, an open-source digital forensics and incident response (DFIR) platform. Any authenticated user, including one holding only the reader role, can terminate the entire server process with a single request. The flaw is triggered by calling SetPassword with a username that does not exist. The condition maps to [CWE-476] Null Pointer Dereference and requires only low-privilege authenticated access over the network.

Critical Impact
A single authenticated request from a low-privileged account crashes the Velociraptor server, disrupting active DFIR investigations and endpoint monitoring workflows.

Affected Products

Velociraptor DFIR server (see vendor advisory for affected version ranges)

Discovery Timeline

2026-08-11 - CVE-2026-18638 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-18638

Vulnerability Analysis

The vulnerability resides in the Velociraptor server's SetPassword API handler. When an authenticated user submits a SetPassword request referencing a username that does not exist in the user database, the server-side logic dereferences a null pointer instead of returning a controlled error response. The unhandled dereference propagates as an unrecovered panic and terminates the entire server process.

Role-based access controls do not gate the vulnerable code path. Users assigned only the reader role, which is intended for read-only visibility into artifacts and hunts, can invoke the method. Because Velociraptor deployments frequently serve as the central collection point for endpoint telemetry, a server crash halts collection and disrupts ongoing incident response operations.

Root Cause

The root cause is missing input validation on the target username before the server attempts to load the associated user record. The lookup returns a nil object for non-existent users, and subsequent code accesses fields on that nil object without a guard, satisfying the conditions for [CWE-476].

Attack Vector

Exploitation requires network access to the Velociraptor GUI or API endpoint and valid credentials at any privilege tier. An attacker sends a single SetPassword request specifying an arbitrary username that is not provisioned on the server. The server panics and the process exits, producing an availability impact without disclosing or modifying data. Refer to the Velociraptor Security Advisory for full technical details.

Detection Methods for CVE-2026-18638

Indicators of Compromise

Unexpected termination of the Velociraptor server process followed by service restart events
Audit log entries showing SetPassword calls originating from reader or other low-privilege accounts
SetPassword requests referencing usernames that do not exist in the Velociraptor user database

Detection Strategies

Alert on any Velociraptor server process exit that is not associated with a scheduled restart or administrator action
Correlate API audit logs for SetPassword invocations with subsequent loss of agent check-ins across the fleet
Baseline expected callers of user-management APIs and flag calls from accounts that should never perform password changes

Monitoring Recommendations

Forward Velociraptor GUI and API access logs to a centralized log platform for retention and correlation
Monitor process supervisor logs (systemd, container orchestrator) for repeated crash-and-restart cycles of the Velociraptor binary
Track authentication events for reader role accounts issuing state-changing API calls

How to Mitigate CVE-2026-18638

Immediate Actions Required

Upgrade the Velociraptor server to the fixed release identified in the vendor advisory
Restrict network access to the Velociraptor GUI and API to trusted management networks and DFIR analyst workstations
Audit user accounts and remove or disable accounts that no longer require access, particularly stale reader accounts

Patch Information

Refer to the Velociraptor Security Advisory for the fixed version and upgrade instructions. Apply the patched release before re-exposing the server to any user accounts.

Workarounds

Place the Velociraptor server behind a reverse proxy or VPN that restricts access to a small set of authenticated administrators until the patch is applied
Rotate credentials for all Velociraptor users, especially low-privilege accounts, to reduce the risk of misuse
Configure the process supervisor to automatically restart the Velociraptor server so that an accidental or malicious trigger does not result in prolonged downtime

bash

# Example: ensure systemd auto-restarts the Velociraptor server after a crash
# /etc/systemd/system/velociraptor_server.service.d/override.conf
[Service]
Restart=always
RestartSec=5s