{"uuid": "003d8141-19e6-4e68-b9fb-db04da7a9507", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-18972", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117077117025006386", "content": "CVE-2026-18972 (CRITICAL): Rapid7 Velociraptor <0.77.2 lets low-priv users escalate to admin by spoofing 'Grpc-Metadata-USER' header \u2014 full account takeover. No patch yet. Restrict GUI access, monitor requests. https://radar.offseq.com/threat/cve-2026-18972-cwe-290-authentication-bypass-by-spoofing-in-rapid7-velociraptor-72ecf6c68bed741e #OffSeq #Velociraptor #CVE202618972", "creation_timestamp": "2026-08-11T13:30:33.437241Z"}