CVE-2026-18635 Velociraptor query plugin allows impersonation in other orgs
Administrators in one organization can impersonate users in other organizations due to incorrect permission checks, enabling unauthorized access and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-18635?
CVE-2026-18635 is a high-severity authentication bypass vulnerability in Rapid7 Velociraptor, published on 11 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller's org instead of against the target org.
This allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission.
Weakness: CWE-863
Which versions are affected by CVE-2026-18635?
How do I fix CVE-2026-18635?
No fix has been published for CVE-2026-18635 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-18635 being exploited?
There is no known exploitation of CVE-2026-18635 in the wild and no public exploit code.
Sources
Also known as GHSA-5h5v-cxvm-wgr3.