CVE-2026-18638 Velociraptor server crash via the SetPassword API

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...

CVE-2026-18638

CVE-2026-18638 : Velociraptor server can be terminated by any authenticated user (even reader role) via SetPassword with a non-existent username, potentially crashing the entire server. Documented impact is server process termination (availability impact: High). No remediation or patch details ar...

CVE-2026-18638 Velociraptor server crash via the SetPassword API

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...