Overview

Velociraptor is a platform that allows for multi-tenant deployments named 'Orgs'. By default, Velociraptor uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org, and Velociraptor examines the ORG_ADMIN permission on the ROOT org to manage Orgs. However, a critical vulnerability, CVE-2026-18860, has been discovered that allows administrators in child orgs to delete other orgs due to incorrect permission checks.

Understanding the Vulnerability / Threat

Root Cause Analysis

The root cause of this vulnerability is the Velociraptor server's incorrect checking of the ORG_ADMIN permission of callers within the calling ORG instead of the ROOT org. This allows an administrator in a child org, which is not also an administrator in the ROOT org, to delete other orgs. This issue belongs to the CWE-280 category, which involves Improper Handling of Insufficient Permissions.

Attack Surface & Vector

This vulnerability lives in the software stack of Velociraptor, specifically in the permission checking mechanism for org administrators. An attacker can reach this vulnerability through a network-adjacent attack vector, as the CVSS vector string indicates AV:N. The attacker needs to have high privileges in the child org, but not in the ROOT org.

Exploitation Mechanics — Scenario Walkthrough

Scenario: Compromising a Velociraptor Deployment through Child Org
  • Initial Position: An attacker is an administrator in a child org within a Velociraptor deployment.
  • Triggering the Flaw: The attacker attempts to delete another org by exploiting the incorrect permission check in Velociraptor. The attacker crafts a request to delete an org, and Velociraptor checks the ORG_ADMIN permission within the calling org (the child org) instead of the ROOT org.
  • What Breaks: Due to the incorrect permission check, Velociraptor allows the deletion of the targeted org. The security boundary fails because the permission check is not correctly verifying the admin status in the ROOT org.
  • Attacker's Prize: The attacker successfully deletes another org, gaining control over the deployment and potentially allowing lateral movement or data exfiltration.

Real-World Impact

An attacker can achieve significant impact by exploiting this vulnerability. They can delete orgs, disrupt operations, and potentially gain unauthorized access to sensitive data. The affected user base includes administrators of child orgs in Velociraptor deployments. The deployment footprint is significant, as Velociraptor is used in various environments.

Detection & Defense

Immediate Mitigations

To address this vulnerability, it is recommended to upgrade Velociraptor to version 0.77.2 or later. This patch fixes the incorrect permission check and prevents administrators in child orgs from deleting other orgs.

Detection Strategies

Defenders can detect exploitation attempts by monitoring Velociraptor logs for unusual org deletion requests. They can also implement SIEM rules to alert on potential exploitation attempts. MITRE ATT&CK techniques such as T1078: Valid Accounts and T1203: Exploitation for Privilege Escalation may be applicable.

Long-Term Hardening

To prevent similar vulnerabilities, it is essential to implement defense-in-depth strategies, such as:
  • Regularly reviewing and updating permission checks
  • Implementing strict access controls and monitoring
  • Conducting regular security audits and penetration testing

Key Takeaways

  • CVE-2026-18860 is a critical vulnerability in Velociraptor that allows administrators in child orgs to delete other orgs.
  • The vulnerability is caused by incorrect permission checks and has a CVSS score of 8.7.
  • Immediate mitigation involves upgrading Velociraptor to version 0.77.2 or later.
  • Defenders should monitor logs and implement SIEM rules to detect potential exploitation attempts.
  • Long-term hardening strategies include regular security audits and penetration testing.

Sources

  • National Vulnerability Database (NVD)
  • Velociraptor documentation and advisories