EUVD-2026-21002
GHSA-3wq5-x8p8-2v3p
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring message handler on the Velociraptor server (primarily Linux) that allows an authenticated remote attacker to write to arbitrary internal server queues via a crafted monitoring message with a malicious queue name. The server handler that receives client monitoring messages does not sufficiently validate the queue name supplied by the client, allowing a rogue client to write arbitrary messages to privileged internal queues. This may lead to remote code execution on the Velociraptor server. Rapid7 Hosted Velociraptor instances are not affected by this vulnerability.
Analysis
Remote code execution in Rapid7 Velociraptor server (versions <0.76.2, primarily Linux) allows authenticated attackers to write arbitrary messages to privileged internal queues via crafted client monitoring messages with malicious queue names. Improper input validation in the server's client monitoring message handler fails to sanitize queue names supplied by rogue clients, enabling queue injection attacks that escalate to RCE. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all self-hosted Velociraptor instances (Rapid7 Hosted is unaffected) and document versions via administrative console or API queries; restrict client enrollment and authentication to trusted networks only via firewall/network segmentation. Within 7 days: Monitor vendor advisory channel (https://velociraptor.velocidex.com) for patch release targeting 0.76.2 or later; prepare upgrade procedure and test in non-production environment. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today