EUVD-2026-57159
GHSA-8f52-5rxc-fj43
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Investigator-level authentication required (PR:L, AV:N); permanent hunt deletion causes both integrity loss and availability loss of forensic data, warranting A:L over the official A:N.
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
Lifecycle Timeline
2DescriptionCVE.org
The hunt_delete() VQL function allows deleting hunts.
Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "investigator" role) instead of the "DELETE_RESULTS" permission (usually only assigned to "administrators").
AnalysisAI
Incorrect authorization in Velociraptor's hunt_delete() VQL function grants investigator-role users the ability to permanently delete hunt results, a privilege that should be restricted to administrators holding the DELETE_RESULTS permission. The platform misapplied the COLLECT_CLIENT permission check in place of the DELETE_RESULTS gate, enabling lateral privilege abuse within authenticated sessions. No public exploit or active exploitation has been identified, but the integrity impact is high because hunt data represents forensic evidence collected during incident response operations.
Technical ContextAI
Velociraptor is an open-source digital forensics and incident response (DFIR) platform that uses Velociraptor Query Language (VQL) - a purpose-built query language for collecting, analyzing, and managing forensic artifacts across endpoints. The hunt_delete() function is a VQL built-in that permanently removes a hunt and its associated collected data. Velociraptor implements role-based access control (RBAC) with roles such as 'investigator' (holding COLLECT_CLIENT and related permissions) and 'administrator' (holding DELETE_RESULTS and other privileged permissions). CWE-863 (Incorrect Authorization) applies precisely here: the authorization logic in hunt_delete() validates the wrong permission - COLLECT_CLIENT - rather than the intended DELETE_RESULTS gate, allowing investigators to perform a destructive administrative action. No CPE strings were provided in the available input data to further bound affected builds.
RemediationAI
The primary remediation is to apply the vendor-released fix documented in the Velociraptor security advisory at http://docs.velociraptor.app/announcements/advisories/cve-2026-64952/. No exact patched version number was present in the provided data - administrators must consult that advisory directly to confirm the minimum safe release before upgrading. As a compensating control pending upgrade, operators should audit investigator-role assignments and restrict that role to only fully trusted internal staff, reducing the population of accounts that could abuse the mischecked permission. Organizations should also review existing audit logs for unexpected invocations of hunt_delete() by investigator-role users to detect any prior abuse. Note that tightening investigator-role membership is an operational trade-off that may impede legitimate DFIR analyst workflows and should be coordinated with incident response teams.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today