CVE-2026-18972: Velociraptor authenticated identity-spoofing vulnerability

Published Aug 11, 2026

Updated

An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack from a user with low privileges to administrator.

Affected Software

1 affected component

Velociraptor Velociraptor

Event History

Aug 11, 2026

CVE Published

via MITRE·12:30 PM

Data Sourced

via MITRE·12:30 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-18972?

The severity of CVE-2026-18972 is rated as critical with a score of 9.6.

How do I fix CVE-2026-18972?

To fix CVE-2026-18972, update to the latest version of Velociraptor that addresses this vulnerability.

What type of vulnerability is CVE-2026-18972?

CVE-2026-18972 is an authenticated identity-spoofing vulnerability that allows attackers to impersonate other users.

Who is affected by CVE-2026-18972?

CVE-2026-18972 affects users of Velociraptor who utilize the GUI and have low privileges.

What can happen if CVE-2026-18972 is exploited?

Exploitation of CVE-2026-18972 can lead to account takeover from a low-privileged user to an administrator.

CVE-2026-18972: Velociraptor authenticated identity-spoofing vulnerability

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-18972?

How do I fix CVE-2026-18972?

What type of vulnerability is CVE-2026-18972?

Who is affected by CVE-2026-18972?

What can happen if CVE-2026-18972 is exploited?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-18972?

How do I fix CVE-2026-18972?

What type of vulnerability is CVE-2026-18972?

Who is affected by CVE-2026-18972?

What can happen if CVE-2026-18972 is exploited?