CVE-2026-18972 — Velociraptor authenticated identity-spoofing vulnerability

CVE-2026-18972

Velociraptor authenticated identity-spoofing vulnerability PUBLISHED

Description (CNA)

An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack from a user with low privileges to administrator.

Affected (CNA)

Vendor / product	Versions
Rapid7 / Velociraptor	affected 0 before 0.77.2

CWE

CWE-290

References

http://docs.velociraptor.app/announcements/advisories/cve-2026-18972/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.