Velociraptor

Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role - to overwrite global artifacts without the elevated permissions normally required for such operations. The `verify()` VQL function, designed only for syntax validation, incorrectly writes submitted artifacts into the shared global repository rather than a temporary local scope, effectively bypassing authorization controls (CWE-862). No public exploit or CISA KEV listing has been identified at time of analysis, but the low privilege bar and network accessibility make this a meaningful internal threat in Velociraptor deployments.

Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, enabling a high-privileged attacker to inject javascript: URIs that execute when a second user clicks the crafted link in the console. The scope change (S:C) in the CVSS vector confirms the XSS crosses the application's security boundary into the victim's browser session, exposing session tokens and permitting authenticated actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis, but the C:H/I:H impact scores reflect meaningful credential theft and session hijacking potential within the Velociraptor investigation console.

Privilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIENT permission check and schedule new client collections, a capability normally restricted to the investigator role. The bypass is achieved by executing a VQL query that resets the authorization provider, collapsing the RBAC boundary between analyst and investigator roles. No public exploit has been identified at time of analysis, though the remediation commit is publicly visible on GitHub.

Account takeover in Rapid7 Velociraptor is possible when the platform is configured to use an external OIDC Identity Provider for authentication. Velociraptor maps OIDC email claims directly to internal usernames without validating the IdP's email_verified flag, enabling an attacker with any account on the same IdP to change their registered email address to match a target user's and seamlessly inherit that user's Velociraptor session and privileges. Given Velociraptor's role as a DFIR and endpoint monitoring platform, successful exploitation could expose sensitive forensic data, endpoint telemetry, and incident response artifacts. No public exploit code has been identified at time of analysis.

Denial of service in Velociraptor allows any authenticated user - including those holding only the read-only reader role - to immediately terminate the entire server process with a single API call. By invoking SetPassword with a username that does not exist, an attacker triggers a null pointer dereference (CWE-476) that crashes the process, rendering the DFIR platform completely unavailable. No public exploit has been identified at time of analysis, but the trivially low exploitation barrier - any valid credential suffices - makes this a credible insider or compromised-account threat in any environment where Velociraptor is operationally depended upon.

Path traversal in Velociraptor's NewNotebook API allows authenticated users holding NOTEBOOK_EDIT permission to write files outside the organization's designated data store directory. While the written file is constrained to the '.json.db' extension, this is sufficient to overwrite critical internal metadata files - including ACL records and hunt configurations - causing data corruption that can undermine the integrity of active forensic investigations. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires a valid authenticated session with a specific permission grant.

Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any org in the deployment by exploiting a misplaced permission check. The server incorrectly validates the ORG_ADMIN permission against the caller's own child org rather than the ROOT org, and child org admins can self-grant this permission within their local ACL scope. An attacker with child org admin credentials can permanently delete peer orgs - including all their forensic artifacts, hunt data, and client configurations - well outside their authorized boundary.

Velociraptor's NTFS parsing library contains out-of-bounds read and memory exhaustion flaws that allow a crash and denial of service when processing maliciously crafted NTFS images. All versions of Rapid7's Velociraptor (cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*) are affected, with meaningful exposure limited to dead disk forensics workflows where untrusted NTFS images are ingested - live filesystem analysis is largely insulated from this attack path. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the local attack vector further constrains real-world exploitation opportunity.

Cross-organizational data exfiltration in Rapid7 Velociraptor's gRPC API allows authenticated ROOT org users to read datastore files belonging to other tenant organizations by bypassing the VFSGetBuffer endpoint's path prefix deny-list. The bypass undermines Velociraptor's multi-tenant isolation model, exposing sensitive DFIR artifacts - forensic evidence, endpoint memory, and investigation files - from organizations the attacker is not authorized to access. No public exploit code has been identified at time of analysis, and exploitation requires pre-existing high-privilege credentials in the ROOT organization.

Out-of-bounds read and memory exhaustion flaws in Velociraptor's NTFS parsing library allow denial of service when processing maliciously crafted NTFS images. Specifically affects deployments using the dead disk forensics workflow where Velociraptor ingests untrusted NTFS image files rather than live filesystems. An attacker who can supply a corrupted NTFS volume to a Velociraptor analyst can crash the tool, disrupting forensic investigations. No public exploit identified at time of analysis; patch available in version 0.77.2 and later.

Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-privileged GUI user to impersonate any other user, including admins, by supplying a crafted 'Grpc-Metadata-USER' header, resulting in full account takeover. The flaw stems from the gRPC/GUI layer trusting a client-supplied identity header instead of the authenticated session. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the fix is trivial to reverse-engineer once the header name is known.

Missing NETWORK ACL enforcement across Velociraptor's upload_azure, upload_sftp, upload_smb, upload_gcs, and related VQL plugins allows an authenticated analyst-role user to force the server to initiate outbound TCP connections to arbitrary attacker-controlled endpoints. This bypasses the intended NETWORK ACL permission boundary - a role separation control designed to prevent analysts from triggering server-side network activity - enabling port-oracle-based reconnaissance of the server's internal network segments and potential data exfiltration to external destinations. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is bounded by the requirement for analyst-role authentication.

Off-by-one error in Velocidex Velociraptor before version 0.76.5 on Windows and Linux causes denial of service when parsing specially crafted .evtx files through the parse_evtx VQL plugin. Local attackers with user-level privileges can crash the Velociraptor process by uploading or providing malformed event log files, disrupting forensic investigations and incident response operations. The vulnerability requires user interaction (file upload/selection) but grants an attacker both integrity and availability impact despite the CVSS 4.4 (Medium) rating.

Cross-organization ACL disclosure in Velocidex Velociraptor before 0.76.5 allows any authenticated low-privilege user to enumerate the full role and permission policy of any user in any organization by abusing the GetUserRoles gRPC endpoint with attacker-chosen Name and Org parameters. The scope-changing flaw (CVSS 3.1 7.7, S:C) breaches tenant isolation in a DFIR platform where multi-org separation is a core trust boundary. No public exploit identified at time of analysis, and EPSS is very low (0.01%), so this is a confidentiality/reconnaissance issue rather than a code-execution or actively-exploited threat.

We need to produce a JSON object with all specified fields, based on provided data. The CVE is CVE-2026-6290, about Velociraptor query() plugin allowing cross-org access in the GUI. Let's synthesize. Inputs: - Description: Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. Authenticated GUI user with access in one org can use the query() plugin in a notebook cell to run VQL queries on other orgs they may not have access to. User's permissions in the other org are same as they have in the org containing the notebook. - CVSS Score: 8.0, Vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - CWE-863: Incorrect Authorization. - EPSS: 0.03% (percentile 8%) - very low exploitation probability. - Patch: Available (from vendor). References include advisory URL: https://docs.velociraptor.app/announcements/advisories/cve-2026-6290/ which presumably mentions fix version 0.76.3. - KEV: not mentioned, so not in CISA KEV. No exploitation evidence. - POC: not mentioned, probably none. - Tags: Authentication Bypass, Velociraptor (maybe they consider the cross-org access as bypassing auth? It says "Authentication Bypass" tag, but it's actually an incorrect authorization after authentication. CWE-863 is Incorrect Authorization, not bypass. We'll stick to description). - SSVC: Exploitation: none, Automatable: no, Technical Impact: total. That means not exploited, not automatable, but total impact if exploited. - ENISA EUVD: lists affected versions: Velociraptor 0 <0.76.3, 0.75.8 (maybe separate branch?). - CPE: cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:* (prior to 0.76.3). - References: advisory from docs.velociraptor.app, NVD page, vuldb. Now, build JSON fields: product_name: "Velociraptor" - simple. summary: Need original synthesis, not copy description. Start with impact verb and product. So: "Incorrect authorization in Velociraptor versions prior to 0.76.3 allows an authenticated GUI user to execute VQL queries on organizations other than their own via the query() plugin in notebooks. The user's permissions in the target org mirror those in the source org. No active exploitation or public exploit code has been reported; EPSS score is low (0.03%)." That covers what, who, impact, exploitation status, EPSS. Use KEV: not present. Mention authenticated, high privileges (PR:H), UI:N, AC:H (complex? High complexity). But we don't need full CVSS in summary. Good. technical_context: Explain underlying technology. Velociraptor is an open-source endpoint visibility, digital forensics, and incident response tool. The query() plugin is a VQL (Velociraptor Query Language) function that allows running queries. The vulnerability relates to authorization checks in multi-org deployments: the plugin fails to properly scope the user's access to only the current organization, allowing cross-org querying. CWE-863 Incorrect Authorization. CPE shows product: rapid7:velociraptor. The affected versions are prior to 0.76.3. So we can mention that. risk_assessment: Use CVSS, EPSS, KEV, SSVC. CVSS: 8.0 high, network vector, high complexity, high privileges, no user interaction, scope changed, high impact all. EPSS 0.03%, very low likelihood of exploitation. KEV not listed. SSVC: Exploitation none, not automatable, but total impact. So real-world risk is low for widespread exploitation due to high privileges required and lack of automation; but if exploited by a malicious insider with high-privileged access in one org, they could compromise other orgs. The high CVSS score reflects the potential damage from an authenticated user, but the EPSS score suggests minimal real-world exploitation. So it's a priority for organizations using multi-org Velociraptor deployments, but not an immediate patch-everything emergency unless you have malicious insiders. No evidence of active exploitation. State clearly: "CVSS score 8.0 indicates high severity, but exploitation requires an authenticated GUI user with high privileges in at least one organization. EPSS probability is 0.03%, suggesting very low likelihood of widespread exploitation. No active exploitation reported (SSVC: exploitation none, not automatable). This vulnerability is primarily a concern for organizations running multi-org Velociraptor with high-privileged users who should not have cross-org access." affected_products: "Velociraptor versions prior to 0.76.3 are affected, as confirmed in vendor advisory (https://docs.velociraptor.app/announcements/advisories/cve-2026-6290/). The CPE identifier is cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*. A specific affected version is 0.75.8, but all versions before 0.76.3 are vulnerable." That covers. No need to list all. remediation: "Upgrade to Velociraptor version 0.76.3 or later, which contains the fix. The vendor advisory at https://docs.velociraptor.app/announcements/advisories/cve-2026-6290/ provides details. As a workaround, restrict the use of the query() plugin in notebooks to only trusted users, or disable multi-org deployments if not needed." Patch available, so primary is upgrade. exploit_scenario: "An attacker who already has authenticated GUI access with high privileges (e.g., administrator) in one organization crafts a malicious VQL query within a notebook cell using the query() plugin. By specifying a target organization other than the current one, the query executes with the attacker's permissions in that target org, potentially accessing artifacts, collected data, or executing further VQL commands. This can lead to cross-org data exfiltration or lateral movement within the Velociraptor server." Note: requires authentication and high privileges, so it's an insider threat or compromised account. exploitation_conditions: Need specific prerequisites. From description: "authenticated GUI user with access in one org" and "using the query() plugin in a notebook cell". So the conditions: user must have an account with high privileges (PR:H from CVSS) and access to at least one organization; multi-org deployment; the query() plugin must be available in notebooks (default). The attack requires the user to intentionally craft queries targeting other orgs. There's no user interaction from the target. So state: "Exploitation requires an authenticated GUI user with high privileges in at least one organization in a multi-org Velociraptor deployment. The user must have access to notebooks and the query() plugin (enabled by default). The attack can be performed without any user interaction or special privileges beyond the initial authentication to the source org." That's precise. attack_chain: Need kill chain steps. Likely: Access (authenticate to GUI) -> Delivery (open notebook cell) -> Exploit (craft VQL query with query() plugin targeting different org) -> Execution (query runs in target org with user's permissions) -> Impact (access/modify data in other org). So: "Authenticate to Velociraptor GUI → Open a notebook cell → Craft VQL query using query() plugin targeting another organization → Query executes in target org with same permissions → Access or modify data across organizations". Can make it concise: "Authenticate to GUI → Create notebook cell → Issue cross-org VQL query via query() plugin → Execute query in target org → Read/write cross-org data". That's 5 steps. Good. confidence_notes: What is confirmed? Vendor advisory confirms the vulnerability and fix version 0.76.3. NVD confirms CVE and scoring. EUVD confirms affected versions. No evidence of exploitation, no POC mentioned. Patch is available. CVSS vector is provided. So confidence high. "Vendor advisory confirms affected versions (<0.76.3) and patch version (0.76.3). NVD assigns CVSS 8.0 with high complexity and privileges. No public exploit or active exploitation reported; EPSS score is low. All critical details appear confirmed." Good. prevalence: How widely deployed is Velociraptor? It's an open-source DFIR tool by Rapid7, not as widespread as enterprise tools like Splunk or Sentinel, but used in security operations. Prevalence likely "medium" - not ubiquitous, but not rare. So "medium". prevalence_basis: "Popular open-source DFIR tool used in enterprise SOCs" - max 12 words. "widely-used digital forensics tool in security operations" but within limit. assessed_cvss_vector: We need our own independent vector. Description: network vector, but requires authenticated GUI access. Attack complexity high? Probably yes, because it requires crafting VQL queries and knowing the org structure. Privileges high (user must have high privileges in at least one org). No user interaction. Scope changed (accessing other org). Impact high for confidentiality, integrity, availability because they can run queries that read, modify artifacts or even execute commands? The description says run VQL queries on other orgs with same permissions; if permissions include high, they could do anything. So C/I/A all high. So same as provided: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. But we must output our own, but it matches. So I'll output that exact vector. But the instructions say "Your OWN independent CVSS 3.1 base-metric vector ... grounded in the description and exploitation conditions — NOT a copy of any score in the input." But the input vector seems reasonable, so we can still use that. We'll output: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H". That's consistent. rationale: "Requires authenticated high-privileged GUI user, high attack complexity due to crafting cross-org queries, and scope change to other organizations." assessed_cvss40_vector: Map to CVSS 4.0 base vector: AV:N, AC:H (attack complexity high), AT:N (no attack requirements just conditions). PR:H (high privileges), UI:N. VC:C, VI:C, VA:C (vulnerable system? In 4.0, vulnerable system is the component being exploited, probably the Velociraptor server API or plugin, so all high impact on vulnerable system, and subsequent system impact? Scope changed: the query() plugin allows accessing other orgs, so there is a subsequent system (the other org's data environment). In CVSS 4.0, if there is a scope change, you set SC/SI/SA accordingly. But the vulnerable component is the plugin that fails to restrict access, allowing impact on a different security scope (other orgs). So VC/VI/VA are the impact on the vulnerable component itself? Actually, the vulnerable component is the query() plugin, and exploiting it allows impact on the target org's data, which is a secondary scope. So SC,SI,SA would reflect the impact on the other org (confidentiality, integrity, availability high). In CVSS 4.0, base metrics: AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. But careful: VC/VI/VA refer to impact on the vulnerable system, i.e., the system that contains the vulnerability (the plugin or server). Does exploiting the vulnerability directly affect the vulnerable system's own confidentiality, integrity, availability? The query runs on the target org, which might be separate virtual scope, but the vulnerable system (the server that processes the query) might still be unaffected except that it now returns data. So maybe the vulnerable system (the plugin) does not suffer a confidentiality/integrity/availability loss itself; the impact is entirely on the subsequent system. Then VC/VI/VA would be N/N/N. However, I think the standard interpretation is that if the vulnerable component's functions allow access to other resources, you set VC/VI/VA to reflect the impact to the vulnerable component itself, but if the scope changes (i.e., you can affect a different component), you set SC/SI/SA to the impact on that other component, and VC/VI/VA to the impact on the vulnerable component if any. Here, the plugin itself isn't harmed, but the attacker can read/write data in another org which is a separate security scope, so VC/VI/VA could be N. But

Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious messages to privileged internal queues via improper queue name validation. Affected versions prior to 0.76.2 (including 0.75.6, 0.74.6, and 0.76.1) are vulnerable to queue injection attacks from rogue authenticated clients. EPSS score of 0.20% (42nd percentile) suggests low broad exploitation probability, though SSVC framework indicates total technical impact despite no confirmed active exploitation. Vendor patch released as version 0.76.2.

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions.  To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and update the configuration. This can lead to arbitrary command execution and endpoint takeover. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator' role).

Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Due to insufficient validation in the PE and OLE parsers in Rapid7's Velociraptor versions earlier than 0.6.8 allows attacker to crash Velociraptor during parsing of maliciously malformed files. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.

A cross-site scripting (XSS) issue in generating a collection report made it possible for malicious clients to inject JavaScript code into the static HTML file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Due to a bug in the handling of the communication between the client and server, it was possible for one client, already registered with their own client ID, to send messages to the server claiming. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting (XSS) issue, where an authenticated user could abuse MIME filetype sniffing to embed. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity.