# CVE-2026-18972: Velociraptor GUI authenticated identity spoofing via Grpc-Metadata-USER header

Source: https://junglewise.ai/threats/cve-2026-18972-velociraptor-gui-authenticated-identity-spoofing-via-grpc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18972 · Severity: critical · CVSS 9.6 · Published 2026-08-11

Velociraptor is a digital forensics and endpoint monitoring platform used by security teams to investigate incidents and collect evidence from computers. An authenticated attacker can hijack another user's identity by forging a custom HTTP header, potentially escalating from a regular user account to administrative privileges and gaining full control of the system.

## Quick answers

**Is CVE-2026-18972 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18972 being exploited in the wild.

**How severe is CVE-2026-18972?** Critical severity, with a CVSS score of 9.6, published 11 August 2026.

**Which products and versions are affected?** Velociraptor Velociraptor before 0.77.2.

**Is there a fix for CVE-2026-18972?** A patch was published on 2026-08-11: Fix available in version 0.77.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18972 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-18972?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an authentication bypass / identity spoofing vulnerability in the Velociraptor GUI. An authenticated attacker can send a specially crafted request with the "Grpc-Metadata-USER" custom header to spoof the identity of another user, including administrators. The vulnerability allows privilege escalation from a low-privileged authenticated user to administrator level. The attack requires the attacker to already have valid authentication credentials and network access to the GUI. Velociraptor has released version 0.77.2 as a patch for this vulnerability.

## Affected products

- Velociraptor Velociraptor before 0.77.2

## Timeline

- 2026-08-11: disclosed
- 2026-08-11: patched: Fix available in version 0.77.2

## References

- [http://docs.velociraptor.app/announcements/advisories/cve-2026-18972/](http://docs.velociraptor.app/announcements/advisories/cve-2026-18972/)