EUVD-2026-22995
GHSA-hv5g-26jg-pc45
Severity by source
Sources disagree (Low–High)AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Any authenticated GUI user (PR:L) can trivially invoke query() in a notebook (AC:L), causing full cross-org scope change (S:C) with C/I/A:H impact.
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are the same as the permissions they have in the org containing the notebook.
AnalysisAI
Multi-tenancy authorization bypass in Velociraptor before 0.76.3 allows authenticated GUI users to execute VQL queries against any organizational tenant using their current ACL token via the query() plugin in notebook cells. The user's permissions in the targeted org mirror those in the org where the notebook resides, meaning a high-privilege user in one org effectively gains equivalent access across all orgs. No public exploit has been identified at time of analysis, and EPSS is very low at 0.03% (8th percentile), though SSVC rates technical impact as total due to the unrestricted cross-org scope change.
Technical ContextAI
Velociraptor (CPE: cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*) is a DFIR and threat-hunting platform by Rapid7 that supports multi-tenancy through a logical organization (org) model, where separate teams or customers share a single server deployment but are isolated by access controls. The query() plugin, invokable from notebook cells in the GUI, is used to run Velociraptor Query Language (VQL) queries. The root cause is CWE-863 (Incorrect Authorization): the plugin fails to confine query execution to the user's current org context, instead presenting the user's ACL token as valid for all org scopes, violating the intended tenant isolation boundary. This is an access control logic flaw, not a credential or session theft issue.
RemediationAI
Upgrade to Velociraptor 0.76.3 or later, which resolves the authorization bypass in the query() plugin. The vendor advisory at https://docs.velociraptor.app/announcements/advisories/cve-2026-6290/ should be consulted for upgrade instructions and release notes. For deployments that cannot immediately patch, a compensating control is to restrict notebook creation and query() plugin usage to only fully trusted, highly privileged users by tightening per-org ACL policies - this reduces the set of accounts that could pivot across orgs but does not eliminate the underlying flaw. Alternatively, consolidating multi-tenant workloads into separate Velociraptor server instances (one per org) eliminates the shared ACL token surface entirely, at the cost of increased operational overhead. Disabling notebook cells for lower-trust users is the most targeted short-term mitigation without restructuring the deployment.
More in Velociraptor
View allPrivilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIEN
Directory traversal in Rapid7 Velociraptor servers running on Linux before 0.75.6 lets a rogue enrolled client upload a
Privilege escalation in Rapid7 Velociraptor lets any user permitted to schedule client monitoring artifacts run otherwis
Privilege escalation in Rapid7 Velociraptor allows an authenticated user holding only the 'investigator' role to execute
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-pr
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8),
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious me
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, e
Template injection in Velociraptor's notebook backup restoration pipeline allows a low-privileged NOTEBOOK_EDITOR user t
Same weakness CWE-863 – Incorrect Authorization
View allVendor StatusVendor
SUSE
Severity: Low| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Fixed |
| SUSE Linux Enterprise Server 16.1 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today