EUVD-2026-75233
GHSA-jfjq-fc5j-227m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Authenticated low-priv user (PR:L) with monitoring-edit rights uses server authority to run arbitrary code on separate endpoints (S:C, C/I/A:H); network-reachable, low complexity.
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
Lifecycle Timeline
4DescriptionCVE.org
Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring artifacts. Additionally there was no requirement that client monitoring artifacts carry the CLIENT_EVENTS type. This allows any user who can schedule client monitoring artifacts to also schedule otherwise restricted artifacts (such as Linux.Sys.BashShell).
AnalysisAI
Privilege escalation in Rapid7 Velociraptor lets any user permitted to schedule client monitoring artifacts run otherwise-restricted artifacts - including Linux.Sys.BashShell - to execute arbitrary commands on managed endpoints. The server enforced the EXECVE permission for scheduling command-execution artifacts through normal collection, but applied no equivalent permission or CLIENT_EVENTS-type check on the client monitoring path, so a low-privileged operator can bypass the gate entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be an authenticated Velociraptor user who already holds the permission/role to schedule or edit client monitoring artifacts (the client event table) - this is the only prerequisite and matches PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, 9.9) reflects a network-reachable server, low attack complexity, an authenticated but low-privileged actor, no user interaction, and a scope change - the compromised server authority is used to execute code on separate client endpoints, which justifies the near-maximal score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor patch: upgrade to the Velociraptor release that incorporates PR #4967 (patch available per vendor advisory; the exact fixed version number is not stated in the provided data - confirm it against http://docs.velociraptor.app/announcements/advisories/cve-2026-19583/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Velociraptor deployments in your environment and document current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Velociraptor
View allPrivilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIEN
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-pr
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8),
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious me
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, e
We need to produce a JSON object with all specified fields, based on provided data. The CVE is CVE-2026-6290, about Velo
Template injection in Velociraptor's notebook backup restoration pipeline allows a low-privileged NOTEBOOK_EDITOR user t
Cross-organization ACL disclosure in Velocidex Velociraptor before 0.76.5 allows any authenticated low-privilege user to
Account takeover in Rapid7 Velociraptor is possible when the platform is configured to use an external OIDC Identity Pro
Share
External POC / Exploit Code
Leaving vuln.today