CVE-2026-18972 PUBLISHED

Velociraptor authenticated identity-spoofing vulnerability

Assigner: rapid7
Reserved: 05.08.2026 Published: 11.08.2026 Updated: 11.08.2026

An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack from a user with low privileges to administrator.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS Score: 9.6

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Rapid7
Product	Velociraptor
Versions	Default: unaffected affected from 0 to 0.77.2 (excl.)

Affected Configurations

The attacker must have access to the Velociraptor GUI with at least the \"reader\" role.

Workarounds

If you have a proxy in front of the Velociraptor GUI server, you can block the \"Grpc-Metadata-USER\" header.

Credits

Yuval Miller finder
Leon Kayaliev finder

References

http://docs.velociraptor.app/announcements/advisories/cve-2026-18972/

Problem Types

CWE-290 Authentication bypass by spoofing CWE

Impacts

CAPEC-21 Exploitation of Trusted Identifiers