CVE-2026-18348

Name of the Vulnerable Software and Affected Versions Velociraptor (affected versions not specified)

Description Missing authorization checks in the upload azure, upload sftp, and upload smb VQL plugins allow an authenticated user with the analyst role to initiate outbound network connections from the server. This bypasses the NETWORK ACL permission boundary, enabling internal network reconnaissance through a port oracle—a technique used to determine if a port is open based on the server's response—and potential data exfiltration to external endpoints.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.