Vulnerability-Lookup

CVE-2026-18635 (GCVE-0-2026-18635)

Vulnerability from cvelistv5 – Published: 2026-08-11 14:15 – Updated: 2026-08-12 18:36

Title

Velociraptor query plugin allows impersonation in other orgs

Summary

Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller's org instead of against the target org. This allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 18:36 UTC

CWE

CWE-863

Assigner

rapid7 mitre root

References

1 reference

URL	Tags
http://docs.velociraptor.app/announcements/adviso…

Impacted products

1 product

Vendor	Product	Version	CPE status
Rapid7	Velociraptor	Affected: 0 , < 0.77.2 (semver)	guessed

Credits

Itay Vardi

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18635",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T18:36:40.599653Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T18:36:53.329Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Velociraptor",
          "repo": "https://github.com/Velocidex/velociraptor/",
          "vendor": "Rapid7",
          "versions": [
            {
              "lessThan": "0.77.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "To exploit this vulnerability, the caller must be an administrator role at an org."
            }
          ],
          "value": "To exploit this vulnerability, the caller must be an administrator role at an org."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Itay Vardi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eVelociraptor\u0027s VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller\u0027s org instead of against the target org.\u003c/p\u003e\u003cdiv\u003eThis allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission.\u003c/div\u003e"
            }
          ],
          "value": "Velociraptor\u0027s VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller\u0027s org instead of against the target org.\n\nThis allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T14:31:17.811Z",
        "orgId": "9974b330-7714-4307-a722-5648477acda7",
        "shortName": "rapid7"
      },
      "references": [
        {
          "url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-18635/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Velociraptor query plugin allows impersonation in other orgs",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Ensure administrator users in child orgs are trusted."
            }
          ],
          "value": "Ensure administrator users in child orgs are trusted."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
    "assignerShortName": "rapid7",
    "cveId": "CVE-2026-18635",
    "datePublished": "2026-08-11T14:15:58.493Z",
    "dateReserved": "2026-08-03T10:21:23.981Z",
    "dateUpdated": "2026-08-12T18:36:53.329Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-18635",
      "date": "2026-08-18",
      "epss": "0.00257",
      "percentile": "0.17465"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-18635\",\"sourceIdentifier\":\"cve@rapid7.com\",\"published\":\"2026-08-11T15:17:28.627\",\"lastModified\":\"2026-08-12T19:17:30.360\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Velociraptor\u0027s VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller\u0027s org instead of against the target org.\\n\\nThis allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission.\"}],\"affected\":[{\"source\":\"cve@rapid7.com\",\"affectedData\":[{\"vendor\":\"Rapid7\",\"product\":\"Velociraptor\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://github.com/Velocidex/velociraptor/\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"0.77.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cve@rapid7.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-12T18:36:40.599653Z\",\"id\":\"CVE-2026-18635\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"cve@rapid7.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"references\":[{\"url\":\"http://docs.velociraptor.app/announcements/advisories/cve-2026-18635/\",\"source\":\"cve@rapid7.com\"}]}}",
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-18T00:17:41Z",
      "cve": "CVE-2026-18635",
      "id": "CVE-2026-18635",
      "initial_release_date": "2026-08-18T00:17:41Z",
      "product_status:known_affected": "5",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-18635",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-18635.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-18635\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-12T18:36:40.599653Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-12T18:36:50.497Z\"}}], \"cna\": {\"title\": \"Velociraptor query plugin allows impersonation in other orgs\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Itay Vardi\"}], \"impacts\": [{\"capecId\": \"CAPEC-122\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-122 Privilege Abuse\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/Velocidex/velociraptor/\", \"vendor\": \"Rapid7\", \"product\": \"Velociraptor\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"0.77.2\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"http://docs.velociraptor.app/announcements/advisories/cve-2026-18635/\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Ensure administrator users in child orgs are trusted.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Ensure administrator users in child orgs are trusted.\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.4\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Velociraptor\u0027s VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller\u0027s org instead of against the target org.\\n\\nThis allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eVelociraptor\u0027s VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller\u0027s org instead of against the target org.\u003c/p\u003e\u003cdiv\u003eThis allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission.\u003c/div\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-863\", \"description\": \"CWE-863\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"To exploit this vulnerability, the caller must be an administrator role at an org.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"To exploit this vulnerability, the caller must be an administrator role at an org.\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"9974b330-7714-4307-a722-5648477acda7\", \"shortName\": \"rapid7\", \"dateUpdated\": \"2026-08-11T14:31:17.811Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-18635\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-12T18:36:53.329Z\", \"dateReserved\": \"2026-08-03T10:21:23.981Z\", \"assignerOrgId\": \"9974b330-7714-4307-a722-5648477acda7\", \"datePublished\": \"2026-08-11T14:15:58.493Z\", \"assignerShortName\": \"rapid7\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-18635

Vulnerability from fkie_nvd - Published: 2026-08-11 15:17 - Updated: 2026-08-12 19:17

Severity

7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	cve@rapid7.com	http://docs.velociraptor.app/announcements/advisories/cve-2026-18635/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Velociraptor",
          "repo": "https://github.com/Velocidex/velociraptor/",
          "vendor": "Rapid7",
          "versions": [
            {
              "lessThan": "0.77.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "cve@rapid7.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Velociraptor\u0027s VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller\u0027s org instead of against the target org.\n\nThis allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission."
    }
  ],
  "id": "CVE-2026-18635",
  "lastModified": "2026-08-12T19:17:30.360",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "cve@rapid7.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-18635",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-12T18:36:40.599653Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-11T15:17:28.627",
  "references": [
    {
      "source": "cve@rapid7.com",
      "url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-18635/"
    }
  ],
  "sourceIdentifier": "cve@rapid7.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "cve@rapid7.com",
      "type": "Secondary"
    }
  ]
}

GHSA-5H5V-CXVM-WGR3

Vulnerability from github – Published: 2026-08-11 15:32 – Updated: 2026-08-11 15:32

Details

This allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission.

Severity

7.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-18635"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-11T15:17:28Z",
    "severity": "HIGH"
  },
  "details": "Velociraptor\u0027s VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller\u0027s org instead of against the target org.\n\nThis allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission.",
  "id": "GHSA-5h5v-cxvm-wgr3",
  "modified": "2026-08-11T15:32:45Z",
  "published": "2026-08-11T15:32:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18635"
    },
    {
      "type": "WEB",
      "url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-18635"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-18635 (GCVE-0-2026-18635)

FKIE_CVE-2026-18635

GHSA-5H5V-CXVM-WGR3

Tags

Sightings

Nomenclature