CVE-2026-18652 Overview
CVE-2026-18652 is an authorization vulnerability in Velociraptor's multi-tenant graphical user interface (GUI). Velociraptor stores sub organizations within the datastore directory as part of its multi-tenant design. The GUI fails to correctly validate requested paths against the prefix deny list, permitting result sets to be read from denied prefixes.
A user with read access to the root organization can access result sets belonging to child organizations. The flaw is tracked under [CWE-862] Missing Authorization and affects cross-tenant data isolation in Velociraptor deployments that host multiple sub orgs.
Critical Impact
Authenticated users with root-org read access can retrieve stacked result sets from child sub organizations, breaking multi-tenant boundaries and exposing potentially sensitive investigative data.
Affected Products
- Velociraptor digital forensics and incident response (DFIR) platform
- Deployments configured with multi-tenant sub organizations
- Velociraptor GUI with users granted root-org read access
Discovery Timeline
- 2026-08-12 - CVE-2026-18652 published to the National Vulnerability Database (NVD)
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-18652
Vulnerability Analysis
Velociraptor is an open-source endpoint monitoring, digital forensics, and cyber response platform. It supports a multi-tenant deployment model where sub organizations (sub orgs) are stored as directories within the main datastore. Each sub org is expected to remain isolated from the parent organization at the authorization layer.
The GUI enforces isolation by consulting a prefix deny list before serving data from the datastore. In the vulnerable code path handling stacked result sets, the requested path is not normalized or evaluated correctly against that deny list. As a result, requests referencing paths that resolve into sub-org data slip past the check.
An authenticated user with read privileges on the root org can therefore retrieve stacked result sets originating from child organizations. This defeats tenant separation and can expose hunt results, artifact collections, and investigative content belonging to other tenants.
Root Cause
The root cause is missing authorization [CWE-862] within the GUI's path-handling logic for stacked result sets. The prefix deny list intended to block cross-tenant access is not applied consistently, allowing paths that reference sub-org datastore locations to bypass the restriction.
Attack Vector
Exploitation requires network access to the Velociraptor GUI and authenticated credentials with high privileges at the root-org level. No user interaction is needed. An attacker leverages standard GUI functionality to request stacked result sets whose paths resolve into denied prefixes, retrieving data from sub orgs the account should not access.
No verified public exploit code is available. See the Velociraptor Security Advisory for vendor-provided technical details.
Detection Methods for CVE-2026-18652
Indicators of Compromise
- GUI access logs showing root-org accounts requesting result-set paths that resolve into sub-org datastore directories.
- Repeated or scripted requests to stacked result-set endpoints referencing paths outside the requesting user's assigned org.
- Unexpected reads of hunt or collection artifacts by accounts that do not normally interact with sub-org data.
Detection Strategies
- Audit Velociraptor GUI request logs for path parameters that traverse into orgs/ or other sub-org datastore prefixes.
- Correlate authenticated user identity with the sub-org that owns the requested artifact and flag mismatches.
- Enable verbose API access logging on the Velociraptor server and review for anomalous result-set access patterns.
Monitoring Recommendations
- Forward Velociraptor server audit logs into a centralized logging or SIEM platform for retention and analysis.
- Alert on privileged root-org accounts accessing artifacts scoped to child organizations.
- Baseline normal analyst behavior per org and generate alerts on deviations involving cross-tenant reads.
How to Mitigate CVE-2026-18652
Immediate Actions Required
- Upgrade Velociraptor to the fixed version identified in the Velociraptor Security Advisory.
- Review and reduce the number of accounts with root-org read privileges to the minimum required for operations.
- Rotate credentials for high-privilege GUI accounts if unauthorized cross-tenant access is suspected.
Patch Information
Refer to the Velociraptor Security Advisory for the fixed release version and upgrade instructions. Apply the vendor-supplied patch on all Velociraptor servers hosting multi-tenant deployments.
Workarounds
- Restrict network access to the Velociraptor GUI to trusted administrator networks only.
- Limit assignment of root-org roles and enforce role-based access control aligned with tenant boundaries.
- Separate highly sensitive investigations into dedicated Velociraptor deployments rather than sub orgs until patched.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
