CVE-2026-18348 — Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins
Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound netw…
Published: 2026-08-11 · CVSS: 4.1 · CVSS 3.1
Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7