CVE Catalog
CVE-2026-18638
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk0.29%
21th percentile - higher than 21% of all known CVEs
Summary
Any authenticated Velociraptor user, including one holding only the reader role, can terminate the entire server process with a single request by calling SetPassword with a username that does not exist.
Risk Assessment
An attacker with minimal privileges can cause denial of service, potentially disrupting organizational operations.
Recommendation
Immediately update Velociraptor to a patched version and restrict access to the SetPassword function to authorized users only.
Original NVD description (English source)
Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.