CVE-2026-78412 Overview
CVE-2026-78412 is an authorization flaw in Velociraptor's WatchEvent gRPC API. The API accepts an OrgId parameter identifying the organization from which event streams should be read. The server validates the caller's API permissions against the caller's own organization rather than against the requested organization. A user with API access in one org can therefore stream events from a different org where they hold no access. The weakness is tracked under CWE-639: Authorization Bypass Through User-Controlled Key and affects multi-tenant Velociraptor deployments that rely on organization boundaries for data separation.
Critical Impact
Authenticated API users in one Velociraptor organization can read event streams from other organizations, breaking tenant isolation and exposing sensitive investigative telemetry.
Affected Products
- Velociraptor digital forensics and incident response (DFIR) platform
- Deployments exposing the gRPC API to API-permitted users
- Multi-organization (multi-tenant) Velociraptor server configurations
Discovery Timeline
- 2026-10-05 - CVE-2026-78412 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-78412
Vulnerability Analysis
Velociraptor supports multi-tenancy through organizations (orgs). Each org has its own clients, hunts, artifacts, and event streams. API callers hold permissions scoped to a specific org. The WatchEvent gRPC endpoint streams server-side events such as artifact collection results, flow updates, and audit events in real time.
The endpoint accepts an OrgId field in the request that selects which org's event bus the server should subscribe the caller to. The server retrieves permissions for the caller's home org and uses those permissions to authorize the subscription, instead of resolving permissions in the context of the OrgId supplied in the request. The authorization decision therefore ignores the actual resource being accessed.
An attacker needs valid API credentials in any organization on the server. Attack complexity is low and no user interaction is required. Impact is limited to confidentiality: events can be read, but the vulnerability does not provide write access or affect availability.
Root Cause
The root cause is a user-controlled key used as the authorization target without re-evaluating permissions against that key. The permission lookup resolves caller.OrgId while the resource lookup resolves request.OrgId. The two values are allowed to diverge. This is a textbook CWE-639 pattern applied to a tenancy boundary.
Attack Vector
Exploitation is performed by any principal that already possesses API-level access to the Velociraptor gRPC endpoint in at least one org. The caller issues a WatchEvent request and sets the OrgId field to the identifier of a target org. The server streams events from the target org back to the caller even though the caller has no role in that org. Technical details and fixed versions are published in the Velociraptor Security Advisory CVE-2026-78412.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-78412
Indicators of Compromise
- WatchEvent gRPC calls where the request OrgId differs from the authenticated caller's assigned org.
- Unusual volume of event-stream subscriptions originating from a single API principal across multiple org identifiers.
- Audit log entries showing successful event subscriptions by users not provisioned in the target org.
Detection Strategies
- Enable Velociraptor audit logging and alert on any API call whose declared OrgId does not match the caller's org membership.
- Correlate gRPC access logs with the org-to-user mapping to flag cross-org subscriptions.
- Baseline normal API consumer behavior and alert on new, previously unseen OrgId values queried by an established principal.
Monitoring Recommendations
- Forward Velociraptor server audit logs and gRPC access logs to a central SIEM for retention and correlation.
- Review API token issuance for least privilege and remove tokens that no longer require access.
- Monitor outbound network connections from the Velociraptor server to confirm event streams terminate only at approved consumers.
How to Mitigate CVE-2026-78412
Immediate Actions Required
- Upgrade Velociraptor to the fixed release listed in the vendor advisory.
- Rotate API credentials and revoke tokens held by users whose cross-org activity cannot be verified as legitimate.
- Audit historical gRPC logs for WatchEvent calls that specify an OrgId the caller does not belong to.
Patch Information
The vendor has published remediation details and fixed versions in the Velociraptor Security Advisory CVE-2026-78412. Apply the vendor-supplied update, which corrects the authorization check to evaluate permissions against the OrgId supplied in the request rather than the caller's home org.
Workarounds
- Restrict network access to the Velociraptor gRPC endpoint so only trusted administrative clients can reach it.
- Reduce API role assignments in multi-tenant deployments until the patched version is applied.
- Where feasible, run single-org deployments or isolate sensitive investigations onto a dedicated Velociraptor server until patching is complete.
# Verify installed Velociraptor server version against the fixed release
velociraptor version
# Restrict gRPC API exposure at the host firewall (example: allow only a management subnet)
iptables -A INPUT -p tcp --dport 8001 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8001 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
