CVE-2026-6948 — Velociraptor versions prior to 0.76.4 contain a resource

title: CVE-2026-6948 - Velociraptor Agent Control Channel Resource Exhaustion
id: scw-2026-05-04-ai-1
status: experimental
level: critical
description: |
  Detects a potential resource exhaustion attack against the Velociraptor server's agent control channel. This rule specifically targets the '/api/v1/agent/control' endpoint with a POST request that results in a 500 Internal Server Error, indicative of an OOM condition triggered by crafted messages from a rogue or compromised Velociraptor client, as described in CVE-2026-6948.
author: SCW Feed Engine (AI-generated)
date: 2026-05-04
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-6948/
tags:
  - attack.impact
  - attack.t1499
logsource:
    category: webserver
detection:
  selection:
      cs-uri:
          - '/api/v1/agent/control'
      cs-method:
          - 'POST'
      sc-status:
          - '500'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse