What is CVE-2026-18636?

CVE-2026-18636 is a medium-severity vulnerability in Rapid7 Velociraptor, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 6.8/10. Published 2026-08-11.

How severe is CVE-2026-18636?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Vulnerability in Rapid7 Velociraptor

CVE-2026-18636

The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefi…

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N.

Affected products

Rapid7 Velociraptor — versions 0

Weakness classification (CWE)

CWE-288 — Authentication Bypass Using an Alternate Path or Channel

References

cve@rapid7.com

Frequently asked questions

What is CVE-2026-18636?: CVE-2026-18636 is a medium-severity vulnerability in Rapid7 Velociraptor, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 6.8/10. Published 2026-08-11.
How severe is CVE-2026-18636?: Medium severity. CVSS v3 base score is 6.8 out of 10.