CVE-2026-18638: Velociraptor server crash via the SetPassword API
Published Aug 11, 2026
·Updated
Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.
Affected Software
1 affected component
Velociraptor server
Event History
Aug 11, 2026
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-18638?
The severity of CVE-2026-18638 is medium with a CVSS score of 6.5.
2
How do I fix CVE-2026-18638?
To mitigate CVE-2026-18638, ensure that only authorized users can access the SetPassword API or limit its accessibility.
3
What is the impact of exploiting CVE-2026-18638?
Exploiting CVE-2026-18638 can cause the Velociraptor server to crash, impacting system availability.
4
Who is affected by CVE-2026-18638?
Any authenticated user of the Velociraptor server, including users with the reader role, is affected by CVE-2026-18638.
5
What kind of vulnerability is CVE-2026-18638?
CVE-2026-18638 is classified as a null pointer dereference vulnerability.