EUVD-2026-21002
GHSA-3wq5-x8p8-2v3p
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring message handler on the Velociraptor server (primarily Linux) that allows an authenticated remote attacker to write to arbitrary internal server queues via a crafted monitoring message with a malicious queue name. The server handler that receives client monitoring messages does not sufficiently validate the queue name supplied by the client, allowing a rogue client to write arbitrary messages to privileged internal queues. This may lead to remote code execution on the Velociraptor server. Rapid7 Hosted Velociraptor instances are not affected by this vulnerability.
AnalysisAI
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious messages to privileged internal queues via improper queue name validation. Affected versions prior to 0.76.2 (including 0.75.6, 0.74.6, and 0.76.1) are vulnerable to queue injection attacks from rogue authenticated clients. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires authenticated Velociraptor client access-attacker must possess valid client credentials or control over an enrolled endpoint with established client certificate. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.5 (High) score reflects significant theoretical impact (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) with network attack vector, high attack complexity, low privilege requirement, and scope change indicating container/trust boundary escape. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised a Velociraptor client endpoint (or obtained valid client credentials through credential theft, insider threat, or lateral movement) connects to the Velociraptor server and sends a crafted client monitoring message. Instead of using legitimate queue names for monitoring data submission, the attacker specifies a malicious queue name targeting an internal privileged queue used for server administrative functions or VQL artifact deployment. … |
| Remediation | Upgrade immediately to Rapid7 Velociraptor version 0.76.2 or later, which implements proper queue name validation in the client monitoring message handler. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Rapid7 Velociraptor server deployments and identify running versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today