AUGUST 15, 2026
Live Feed
Back to database
Case File

CVE-2026-18636

MEDIUM · CVSS 6.8 EPSS 0.24%

Source: NVD + CISA KEV + EPSS · Published 2026-08-11 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

The Velociraptor gRPC API's VFSGetBuffer endpoint is vulnerable due to a bypass in the prefix check mechanism, enabling unauthorized users to read sensitive files from the datastore. This flaw can lead to unauthorized access to files across different organizations if the user has read permissions in the ROOT organization. Organizations utilizing the Velociraptor API should prioritize remediation to prevent potential data breaches and unauthorized data exposure.

CVE
CVE-2026-18636
Severity
MEDIUM
CVSS
6.8
EPSS
0.24%

Original NVD Description

The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to access usually denied files. If the user has read permission in the ROOT org, this allows access to other orgs, in which the user may not have permission.