EUVD-2026-57068
GHSA-j6jv-j266-988h
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Analyst credentials required (PR:L), crafting the VQL authorization-reset is non-trivial (AC:H), and investigator-level reach extends to other endpoints causing a scope change (S:C).
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider.
This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role.
AnalysisAI
Privilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIENT permission check and schedule new client collections, a capability normally restricted to the investigator role. The bypass is achieved by executing a VQL query that resets the authorization provider, collapsing the RBAC boundary between analyst and investigator roles. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Velociraptor account with the 'analyst' role and the ability to execute arbitrary VQL queries within notebooks - the standard analyst capability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.2 (High) with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N captures several important dimensions: network reachability via Velociraptor's web interface, low-privilege authentication (analyst role), non-trivial attack complexity requiring specific VQL knowledge to trigger the authorization reset, and a scope change reflecting cross-component impact as the attacker gains authority over client endpoints they do not own. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Velociraptor analyst opens a notebook and crafts a VQL query designed to trigger a reset of the internal authorization provider, effectively clearing the COLLECT_CLIENT permission gate. After executing the query, the analyst submits a new collection task targeting endpoint clients they would not normally have authority to task, operating with investigator-level reach. … |
| Remediation | Apply the upstream fix from commit d7de958e846d3742a7a3a8538fd463e4f12fc528 available at https://github.com/Velocidex/velociraptor/commit/d7de958e846d3742a7a3a8538fd463e4f12fc528; the exact patched release version should be confirmed against the official advisory at http://docs.velociraptor.app/announcements/advisories/cve-2026-64954/ as a formally tagged release was not confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit Velociraptor's activity logs for suspicious VQL execution patterns indicating authorization bypass attempts, and immediately restrict analyst-role access to the notebook feature. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Velociraptor
View allPrivilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-pr
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8),
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious me
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, e
We need to produce a JSON object with all specified fields, based on provided data. The CVE is CVE-2026-6290, about Velo
Cross-organization ACL disclosure in Velocidex Velociraptor before 0.76.5 allows any authenticated low-privilege user to
Account takeover in Rapid7 Velociraptor is possible when the platform is configured to use an external OIDC Identity Pro
Out-of-bounds read and memory exhaustion flaws in Velociraptor's NTFS parsing library allow denial of service when proce
Path traversal in Velociraptor's NewNotebook API allows authenticated users holding NOTEBOOK_EDIT permission to write fi
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today