Sentinel update: server crash fixed in Velociraptor
Any authenticated Velociraptor user could stop the server with one SetPassword request. Rapid7 fixed it in v0.77.2.
Mobasi Research
This Sentinel update covers a Velociraptor vulnerability that became public on August 11, 2026. Rapid7 published it as CVE-2026-18638.
Velociraptor
Velociraptor is an open-source endpoint monitoring, digital forensics, and incident response platform. One server collects artifacts and runs hunts across many endpoints, so if the server stops, collection stops on every endpoint.
Server Crash via the SetPassword API
medium- Issue
- The
SetPasswordAPI did not make sure that the target user exists. A request with a username that does not exist caused a null pointer dereference. - Impact
- Any authenticated user, including a user with only the
readerrole, can stop the full server process with one request. The server is unavailable to all users and endpoints until it restarts. - Advisory
- CVE-2026-18638
Rapid7 fixed the issue in Velociraptor v0.77.2, released August 10, 2026. Update to v0.77.2 or later.
Current Sentinel index
The Sentinel page remains the running public index of disclosed vulnerabilities and remediation status across our reviews.