CVE-2026-18640 Overview
CVE-2026-18640 is a path traversal vulnerability [CWE-22] in the Velociraptor NewNotebook API. The API fails to sufficiently sanitize its parameters, allowing an authenticated user with NOTEBOOK_EDIT permission to write notebook records outside the organization's data store directory. Written files must carry a .json.db extension but can overwrite other metadata files, including Access Control List (ACL) records and hunt records. Attackers exploiting this flaw can corrupt server metadata and cause data integrity loss across the deployment.
Critical Impact
An authenticated user with NOTEBOOK_EDIT permission can overwrite arbitrary metadata files ending in .json.db, corrupting ACLs, hunts, and other server state.
Affected Products
- Velociraptor (see the Velociraptor Advisory for CVE-2026-18640 for affected versions)
Discovery Timeline
- 2026-08-11 - CVE-2026-18640 published to the National Vulnerability Database (NVD)
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-18640
Vulnerability Analysis
The vulnerability resides in Velociraptor's NewNotebook API endpoint. When a client calls the API to create a notebook, parameters supplied by the user are used to derive the on-disk path for the resulting notebook record. The API does not adequately validate or sanitize these parameters against directory traversal sequences.
An authenticated user holding the NOTEBOOK_EDIT permission can craft parameters that cause the server to write the notebook record outside the intended per-organization data store directory. The server enforces a fixed .json.db extension on the output file, which bounds the attack but does not prevent it. Many Velociraptor server metadata files, including ACL records and hunt records, also use .json.db, so an attacker can select paths that overwrite these files.
Overwriting an ACL record can corrupt authorization state. Overwriting a hunt record can destroy investigation artifacts. The result is data corruption and potential loss of forensic evidence stored on the server.
Root Cause
The root cause is insufficient input sanitization in the NewNotebook API's parameter handling logic [CWE-22]. User-controlled input flows into filesystem path construction without normalization or containment checks that would confine the resulting path to the organization's data store directory.
Attack Vector
Exploitation requires network access to the Velociraptor server and valid credentials for an account granted the NOTEBOOK_EDIT permission. The attacker submits a NewNotebook API request with parameters containing traversal sequences that resolve to a target file path outside the org data store. Because the write is constrained to .json.db files, the attacker targets existing metadata files with that extension. Refer to the Velociraptor Advisory for CVE-2026-18640 for technical specifics.
Detection Methods for CVE-2026-18640
Indicators of Compromise
- Unexpected modification timestamps on .json.db metadata files outside notebook directories, particularly ACL and hunt records.
- NewNotebook API calls originating from accounts that do not typically author notebooks.
- Notebook API request payloads containing path traversal sequences such as ../ in notebook identifier or path parameters.
Detection Strategies
- Audit Velociraptor server logs for NewNotebook API calls and correlate the user, timestamp, and supplied parameters against expected notebook workflows.
- Deploy file integrity monitoring on the Velociraptor server data store to alert on writes to ACL and hunt metadata files that occur outside normal administrative activity.
- Baseline the set of users granted NOTEBOOK_EDIT and alert on new grants or use of the permission by rarely active accounts.
Monitoring Recommendations
- Forward Velociraptor API and audit logs to a central analytics platform for retention and correlation with authentication events.
- Monitor for sudden ACL changes or missing hunt records that could indicate metadata corruption from exploitation.
- Track filesystem write patterns on the Velociraptor server host to detect out-of-directory writes by the server process.
How to Mitigate CVE-2026-18640
Immediate Actions Required
- Upgrade Velociraptor to the fixed release identified in the Velociraptor Advisory for CVE-2026-18640.
- Review all accounts holding the NOTEBOOK_EDIT permission and revoke it from users who do not require notebook authoring.
- Back up server metadata files, including ACL and hunt records, so corruption can be reversed.
Patch Information
Refer to the Velociraptor Advisory for CVE-2026-18640 for the fixed version and upgrade instructions from the Velociraptor project.
Workarounds
- Restrict NOTEBOOK_EDIT permission to a minimal set of trusted operators until the patch is applied.
- Restrict network access to the Velociraptor server GUI and API to trusted administrative networks.
- Enable filesystem integrity monitoring on the server data store to detect unauthorized writes to .json.db metadata files.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
