{"vulnerability": "cve-2026-18972", "sightings": [{"uuid": "e0842eef-a665-450e-8ffe-9cef031c4662", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-18972", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3msspwvfmu422", "content": "Rapid7 Velociraptor <0.77.2 hit by CRITICAL CVE-2026-18972 \u2014 auth bypass lets low-priv users spoof admins for account takeover. No patch yet: restrict access, monitor logs. https://radar.offseq.com/threat/cve-2026-18972-cwe-290-authentication-bypass-by-spoofing-in-rapid7-velociraptor-72ecf6c68bed...", "creation_timestamp": "2026-08-11T13:30:35.974206Z"}, {"uuid": "003d8141-19e6-4e68-b9fb-db04da7a9507", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-18972", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117077117025006386", "content": "CVE-2026-18972 (CRITICAL): Rapid7 Velociraptor <0.77.2 lets low-priv users escalate to admin by spoofing 'Grpc-Metadata-USER' header \u2014 full account takeover. No patch yet. Restrict GUI access, monitor requests. https://radar.offseq.com/threat/cve-2026-18972-cwe-290-authentication-bypass-by-spoofing-in-rapid7-velociraptor-72ecf6c68bed741e #OffSeq #Velociraptor #CVE202618972", "creation_timestamp": "2026-08-11T13:30:33.437241Z"}, {"uuid": "0e8c2636-2170-4bd7-b901-88dade79e8a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18972", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mssqhudt462q", "content": "CVE-2026-18972 - velociraptor\nAn attacker can take over a low-privilege user's account by sending fake login information. This is a concern because it allows a malicious user to gain administrator\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#velociraptor #rapid7 #CVE #infosec", "creation_timestamp": "2026-08-11T13:40:04.208914Z"}, {"uuid": "ad135c3f-8636-4713-ab9e-a8aff79d4732", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-18972", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/rapid7-security-advisory-av26-801", "content": "", "creation_timestamp": "2026-08-11T20:15:25.099761Z"}]}