CVE-2026-18635: Velociraptor query plugin allows impersonation in other orgs
Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller's org instead of against the target org.
This allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Velociraptorto a version that resolves this vulnerability.Fixed in 0.77.2 - Configuration
Ensure Velociraptor evaluates the IMPERSONATE permission against the target org (not the caller's org). Versions prior to 0.77.2 evaluate against the caller's org instead; upgrade to 0.77.2 to correct this.
Velociraptor VQL query() plugin IMPERSONATE permission evaluation scope = Evaluate against the target org/user context
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18635?
The severity of CVE-2026-18635 is medium, rated at 6.2 on the CVSS scale.
How do I fix CVE-2026-18635?
To address CVE-2026-18635, ensure you update to the latest version of Velociraptor that includes fixes for the NTFS parsing issues.
What types of attacks can exploit CVE-2026-18635?
CVE-2026-18635 can be exploited through maliciously crafted NTFS images that trigger out of bounds and memory exhaustion bugs in the parser.
What impact does CVE-2026-18635 have on my system?
CVE-2026-18635 may lead to crashes in Velociraptor when processing invalid NTFS volumes, potentially disrupting services.
Is my system vulnerable to CVE-2026-18635 if I don't use Velociraptor?
If you do not utilize Velociraptor or its NTFS parsing library, your system is not directly impacted by CVE-2026-18635.