CVE-2026-18636: Velociraptor VFSGetBuffer API path deny list bypass
Published Aug 11, 2026
·Updated
The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to access usually denied files. If the user has read permission in the ROOT org, this allows access to other orgs, in which the user may not have permission.
Affected Software
1 affected component
Velociraptor gRPC API
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement/enable a prefix check for the VFSGetBuffer requested path against a list of denied prefixes to prevent bypass and block reading sensitive files and accessing other orgs that users cannot access.
Velociraptor gRPC API (VFSGetBuffer endpoint) requested path prefix deny list = configured denied prefixes
Event History
Aug 11, 2026
CVE Published
via MITRE·02:40 PM
Data Sourced
via MITRE·02:40 PM
DescriptionSeverityWeakness