EUVD-2026-64703
GHSA-jj5c-prr4-v82g
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
PR:L reflects NOTEBOOK_EDIT analyst role requirement; UI:R because full endpoint impact requires a privileged user to trigger the overwritten artifact; S:C as artifacts execute on managed endpoint agents.
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
Lifecycle Timeline
4DescriptionCVE.org
The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker need only have the NOTEBOOK_EDIT permission (e.g. an analyst role) to be able to call this function.
AnalysisAI
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role - to overwrite global artifacts without the elevated permissions normally required for such operations. The verify() VQL function, designed only for syntax validation, incorrectly writes submitted artifacts into the shared global repository rather than a temporary local scope, effectively bypassing authorization controls (CWE-862). No public exploit or CISA KEV listing has been identified at time of analysis, but the low privilege bar and network accessibility make this a meaningful internal threat in Velociraptor deployments.
Technical ContextAI
Velociraptor is a digital forensics and incident response (DFIR) platform developed by Rapid7 that uses VQL (Velociraptor Query Language) to define, store, and execute collection artifacts on managed endpoints. Artifacts are YAML-structured query definitions held in a server-side repository; the global repository controls what queries are dispatched to enrolled agents. The verify() VQL function is intended exclusively for notebook-context syntax validation of user-provided artifact definitions. Due to a scoping fault, however, the implementation passes submitted artifacts directly to the global repository rather than a transient local one - as confirmed by the PR #4962 fix, which adds a repository="local" parameter and the code comment 'Make sure the verified artifacts are not loaded into the global repository.' This constitutes CWE-862 (Missing Authorization): the function applies no authorization check to prevent a low-privileged caller from mutating the shared artifact store. The affected product is identified by CPE cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*, covering all versions.
RemediationAI
Consult the vendor advisory at http://docs.velociraptor.app/announcements/advisories/cve-2026-19200/ and apply the patched Velociraptor release once published - the upstream fix in PR #4962 scopes the verify() function to a local repository, preventing writes to the global artifact store. An exact release version is not yet confirmed from available data, so monitor the Velocidex GitHub repository and vendor advisory for a tagged release. As an interim compensating control, restrict the NOTEBOOK_EDIT permission to fully trusted users only, removing it from general analyst roles - note this will limit notebook-based artifact authoring workflows for those users. Additionally, implement monitoring or integrity checks on the global artifact repository to detect unexpected modifications to baseline artifacts such as Windows.Sigma.EventLogs, Windows.System.PowerShell, or Linux.Sys.BashShell, as these are high-value overwrite targets given their execution capabilities.
More in Velociraptor
View allPrivilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIEN
Directory traversal in Rapid7 Velociraptor servers running on Linux before 0.75.6 lets a rogue enrolled client upload a
Privilege escalation in Rapid7 Velociraptor lets any user permitted to schedule client monitoring artifacts run otherwis
Privilege escalation in Rapid7 Velociraptor allows an authenticated user holding only the 'investigator' role to execute
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-pr
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8),
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious me
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, e
Multi-tenancy authorization bypass in Velociraptor before 0.76.3 allows authenticated GUI users to execute VQL queries a
Template injection in Velociraptor's notebook backup restoration pipeline allows a low-privileged NOTEBOOK_EDITOR user t
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today