CVE-2026-18652: Velociraptor STACK Type Download Path Bypasses Denied Prefix Check
Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes.
In particular, a user with read access to the root org can access result sets from child orgs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix/verify that the GUI path requested for stacked result sets is checked correctly against the configured prefix deny list, and that result sets are blocked from reading data under denied prefixes across child orgs.
Velociraptor GUI (multi-tenant org boundary checks) prefix deny list enforcement = Ensure the GUI requested path is correctly validated against the deny list (deny access when the requested path resolves under denied prefixes) - Compensating control
Use an external control (e.g., datastore access restrictions) so that users with root org read access cannot access stacked result sets from child orgs outside the intended org boundary.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18652?
The severity of CVE-2026-18652 is rated as medium with a score of 4.9.
What vulnerability does CVE-2026-18652 describe?
CVE-2026-18652 describes a vulnerability in Velociraptor that allows reading Stacked result sets due to incorrect prefix checks.
How can I mitigate CVE-2026-18652?
To mitigate CVE-2026-18652, ensure that prefix checks are correctly implemented to restrict access to denied prefixes.
Which software is affected by CVE-2026-18652?
CVE-2026-18652 affects the Velociraptor software.
When was CVE-2026-18652 published?
CVE-2026-18652 was published on August 12, 2026.