CVE-2026-18972: Velociraptor authenticated identity-spoofing vulnerability

Published on 2026-07-31 Vulnogram
CVSS · CRITICAL · 9.6 ⁄10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Scoring scenario: GENERAL
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
Description

An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header "Grpc-Metadata-USER". This can lead to an account takeover attack from a user with low privileges to administrator.

Problem CWE-290 Authentication bypass by spoofing
Required configuration for exposure The attacker must have access to the Velociraptor GUI with at least the "reader" role.
Workarounds If you have a proxy in front of the Velociraptor GUI server, you can block the "Grpc-Metadata-USER" header.
ProductAffected
Rapid7 Velociraptor on Linux
source repo
Default status is unaffected 		before 0.77.2
Credits
  • Yuval Miller
    •
  • Leon Kayaliev
    •
References