Executive brief
Velociraptor is a digital forensics and incident response platform that collects and analyzes endpoint data across an organization. Any authenticated user with even minimal read-only permissions can crash the entire Velociraptor server by calling the SetPassword API with a non-existent username, causing service disruption and preventing all investigation and response activities.
Technical details
The vulnerability is a denial-of-service flaw in Velociraptor's SetPassword API endpoint. An authenticated user—even one with only the reader role—can trigger a server-wide crash by invoking SetPassword with a username that does not exist in the system. The root cause appears to be improper error handling or input validation in the password-setting logic when the target user is not found. The attack requires valid authentication credentials but no special privileges, and can be executed with a single request. The fix is available in version 0.77.2 or later.
Affected products
- Rapid7 Velociraptor before 0.77.2
Timeline
- 2026-08-11: disclosed
- 2026-08-11: patched: version 0.77.2