CVE-2026-18636
MEDIUM
NVD
CVSS Score
6.8
Severity
MEDIUM
Published
Aug 11, 2026
Vendor
unknown
Description
The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to access usually denied files. If the user has read permission in the ROOT org, this allows access to other orgs, in which the user may not have permission.