Velociraptor
Monthly
Privilege escalation in Rapid7 Velociraptor allows an authenticated user holding only the 'investigator' role to execute arbitrary VQL statements with administrator privileges on the Velociraptor server by populating the internal 'compiled_collector_args' field when submitting a hunt-creation/scheduling API request. Because the server accepts this internal field from the caller, the attacker-supplied pre-compiled VQL is trusted and the ACL checks that normally gate artifact compilation are skipped (CVSS 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exploitation requires a valid investigator-or-higher account that can schedule hunts, making this an insider/privilege-escalation path rather than an unauthenticated remote compromise; no public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status was provided. The vendor advisory is published at https://docs.velociraptor.app/announcements/advisories/cve-2026-19072/.
Template injection in Velociraptor's notebook backup restoration pipeline allows a low-privileged NOTEBOOK_EDITOR user to execute arbitrary VQL queries at elevated server-level permissions. The daily backup feature - enabled by default - captures notebook cell content verbatim; when an administrator later restores the backup, that content is interpolated into a Go template without ACL enforcement, breaking the privilege boundary between analyst and server roles. No public exploit has been identified at time of analysis, but the chained attack path (plant payload, wait for restore) represents a credible insider or compromised-analyst escalation vector against DFIR infrastructure.
Privilege escalation in Rapid7 Velociraptor lets any user permitted to schedule client monitoring artifacts run otherwise-restricted artifacts - including Linux.Sys.BashShell - to execute arbitrary commands on managed endpoints. The server enforced the EXECVE permission for scheduling command-execution artifacts through normal collection, but applied no equivalent permission or CLIENT_EVENTS-type check on the client monitoring path, so a low-privileged operator can bypass the gate entirely. No public exploit identified at time of analysis, though the upstream fix (PR #4967) makes the missing check straightforward to reconstruct.
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role - to overwrite global artifacts without the elevated permissions normally required for such operations. The `verify()` VQL function, designed only for syntax validation, incorrectly writes submitted artifacts into the shared global repository rather than a temporary local scope, effectively bypassing authorization controls (CWE-862). No public exploit or CISA KEV listing has been identified at time of analysis, but the low privilege bar and network accessibility make this a meaningful internal threat in Velociraptor deployments.
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, enabling a high-privileged attacker to inject javascript: URIs that execute when a second user clicks the crafted link in the console. The scope change (S:C) in the CVSS vector confirms the XSS crosses the application's security boundary into the victim's browser session, exposing session tokens and permitting authenticated actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis, but the C:H/I:H impact scores reflect meaningful credential theft and session hijacking potential within the Velociraptor investigation console.
Privilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIENT permission check and schedule new client collections, a capability normally restricted to the investigator role. The bypass is achieved by executing a VQL query that resets the authorization provider, collapsing the RBAC boundary between analyst and investigator roles. No public exploit has been identified at time of analysis, though the remediation commit is publicly visible on GitHub.
Account takeover in Rapid7 Velociraptor is possible when the platform is configured to use an external OIDC Identity Provider for authentication. Velociraptor maps OIDC email claims directly to internal usernames without validating the IdP's email_verified flag, enabling an attacker with any account on the same IdP to change their registered email address to match a target user's and seamlessly inherit that user's Velociraptor session and privileges. Given Velociraptor's role as a DFIR and endpoint monitoring platform, successful exploitation could expose sensitive forensic data, endpoint telemetry, and incident response artifacts. No public exploit code has been identified at time of analysis.
Path traversal in Velociraptor's NewNotebook API allows authenticated users holding NOTEBOOK_EDIT permission to write files outside the organization's designated data store directory. While the written file is constrained to the '.json.db' extension, this is sufficient to overwrite critical internal metadata files - including ACL records and hunt configurations - causing data corruption that can undermine the integrity of active forensic investigations. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires a valid authenticated session with a specific permission grant.
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any org in the deployment by exploiting a misplaced permission check. The server incorrectly validates the ORG_ADMIN permission against the caller's own child org rather than the ROOT org, and child org admins can self-grant this permission within their local ACL scope. An attacker with child org admin credentials can permanently delete peer orgs - including all their forensic artifacts, hunt data, and client configurations - well outside their authorized boundary.
Out-of-bounds read and memory exhaustion flaws in Velociraptor's NTFS parsing library allow denial of service when processing maliciously crafted NTFS images. Specifically affects deployments using the dead disk forensics workflow where Velociraptor ingests untrusted NTFS image files rather than live filesystems. An attacker who can supply a corrupted NTFS volume to a Velociraptor analyst can crash the tool, disrupting forensic investigations. No public exploit identified at time of analysis; patch available in version 0.77.2 and later.
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-privileged GUI user to impersonate any other user, including admins, by supplying a crafted 'Grpc-Metadata-USER' header, resulting in full account takeover. The flaw stems from the gRPC/GUI layer trusting a client-supplied identity header instead of the authenticated session. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the fix is trivial to reverse-engineer once the header name is known.
Cross-organization ACL disclosure in Velocidex Velociraptor before 0.76.5 allows any authenticated low-privilege user to enumerate the full role and permission policy of any user in any organization by abusing the GetUserRoles gRPC endpoint with attacker-chosen Name and Org parameters. The scope-changing flaw (CVSS 3.1 7.7, S:C) breaches tenant isolation in a DFIR platform where multi-org separation is a core trust boundary. No public exploit identified at time of analysis, and EPSS is very low (0.01%), so this is a confidentiality/reconnaissance issue rather than a code-execution or actively-exploited threat.
Multi-tenancy authorization bypass in Velociraptor before 0.76.3 allows authenticated GUI users to execute VQL queries against any organizational tenant using their current ACL token via the query() plugin in notebook cells. The user's permissions in the targeted org mirror those in the org where the notebook resides, meaning a high-privilege user in one org effectively gains equivalent access across all orgs. No public exploit has been identified at time of analysis, and EPSS is very low at 0.03% (8th percentile), though SSVC rates technical impact as total due to the unrestricted cross-org scope change.
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious messages to privileged internal queues via improper queue name validation. Affected versions prior to 0.76.2 (including 0.75.6, 0.74.6, and 0.76.1) are vulnerable to queue injection attacks from rogue authenticated clients. EPSS score of 0.20% (42nd percentile) suggests low broad exploitation probability, though SSVC framework indicates total technical impact despite no confirmed active exploitation. Vendor patch released as version 0.76.2.
Privilege-model bypass in Rapid7 Velociraptor's Windows.Sysinternals.SysmonLogForward artifact allows an authenticated operator who holds only the COLLECT_CLIENT permission (typically the built-in 'Investigator' role) to launch an arbitrary, attacker-chosen binary on monitored Windows endpoints instead of the installed Sysmon binary. Because the artifact exposes a user-controllable binary-path parameter and fails to enforce the additional EXECVE permission that gates comparable dangerous artifacts, successful collection results in code execution on the endpoint under the elevated privileges the artifact normally runs with, yielding high confidentiality, integrity, and availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exploitation is not anonymous: the attacker must already be a trusted Velociraptor operator with artifact-collection rights, and the chosen binary must be reachable or placeable on the target endpoint, which narrows realistic exposure to insiders or compromised operator accounts. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue is a moderate, privilege-escalation class flaw rather than a mass-exploitation threat.
Incorrect authorization in Rapid7 Velociraptor allows an authenticated user with the LABEL_CLIENTS permission to alter server-wide metadata via the SetClientMetadata operation, which should be restricted to server administrators. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) and classified as CWE-863 (Incorrect Authorization), producing high integrity impact with no confidentiality or availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis; the primary risk is privilege escalation for insiders or compromised low-privilege accounts, with impact scaling to how broadly LABEL_CLIENTS is delegated in a given deployment.
Cross-tenant event-stream disclosure in Rapid7 Velociraptor lets an authenticated API user who holds event-watching privileges in one organization read WatchEvent gRPC streams belonging to a different organization they are not authorized for, because the server validates permissions against the caller's own OrgId instead of the OrgId supplied in the request. Only multi-org (multi-tenant) deployments with more than one Org defined are meaningfully exposed; single-org installs have no other tenant to pivot to, and the impact is confidentiality-only with no write or denial-of-service effect. Exploitation requires valid low-privileged API credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and no public exploit code was identified at time of analysis.
Authenticated users of Rapid7 Velociraptor can trigger a server-side deadlock in the platform's user-management module, hanging server operations and causing a denial of service (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Exploitation requires only a valid low-privileged account that can reach the user-management code path over the network - no user interaction, no elevated role, and no special configuration - but it offers no data read, modification, or code execution, so it cannot be used for initial access or lateral escalation. Impact is availability-only (CWE-833, lock management bug); no public exploit identified at time of analysis, no CISA KEV listing, and the vendor advisory is the authoritative source for version-specific guidance.
Parsing a malformed Windows prefetch file through Velociraptor's bundled prefetch library (Velocidex/go-prefetch) can trigger an out-of-bounds condition and crash the parsing operation, an availability-only impact with no data disclosure or code execution. The issue is local and interaction-dependent: exploitation requires that an attacker-supplied or corrupted .pf artifact reach a location the parser processes and that a user or agent run the parse, consistent with the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (the vendor-facing score of 3.6 rates it slightly higher with scope change and low integrity impact). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this is a genuinely low-priority defect that should be handled through routine dependency-update hygiene rather than emergency response.
Denial of service in Velociraptor allows any authenticated user - including those holding only the read-only reader role - to immediately terminate the entire server process with a single API call. By invoking SetPassword with a username that does not exist, an attacker triggers a null pointer dereference (CWE-476) that crashes the process, rendering the DFIR platform completely unavailable. No public exploit has been identified at time of analysis, but the trivially low exploitation barrier - any valid credential suffices - makes this a credible insider or compromised-account threat in any environment where Velociraptor is operationally depended upon.
Velociraptor's NTFS parsing library contains out-of-bounds read and memory exhaustion flaws that allow a crash and denial of service when processing maliciously crafted NTFS images. All versions of Rapid7's Velociraptor (cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*) are affected, with meaningful exposure limited to dead disk forensics workflows where untrusted NTFS images are ingested - live filesystem analysis is largely insulated from this attack path. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the local attack vector further constrains real-world exploitation opportunity.
Cross-organizational data exfiltration in Rapid7 Velociraptor's gRPC API allows authenticated ROOT org users to read datastore files belonging to other tenant organizations by bypassing the VFSGetBuffer endpoint's path prefix deny-list. The bypass undermines Velociraptor's multi-tenant isolation model, exposing sensitive DFIR artifacts - forensic evidence, endpoint memory, and investigation files - from organizations the attacker is not authorized to access. No public exploit code has been identified at time of analysis, and exploitation requires pre-existing high-privilege credentials in the ROOT organization.
Missing NETWORK ACL enforcement across Velociraptor's upload_azure, upload_sftp, upload_smb, upload_gcs, and related VQL plugins allows an authenticated analyst-role user to force the server to initiate outbound TCP connections to arbitrary attacker-controlled endpoints. This bypasses the intended NETWORK ACL permission boundary - a role separation control designed to prevent analysts from triggering server-side network activity - enabling port-oracle-based reconnaissance of the server's internal network segments and potential data exfiltration to external destinations. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is bounded by the requirement for analyst-role authentication.
Velociraptor versions prior to 0.76.4 allow authenticated users with reader role in the root organization to bypass cross-organization authorization controls via HTTP API GET requests, enabling them to read arbitrary files from other organizations regardless of their permissions in those target organizations. The vulnerability requires high privilege context (authenticated reader in root org) but has high confidentiality impact across organization boundaries. This is a horizontal privilege escalation affecting multi-tenant deployments where organizational isolation is a critical security boundary.
Off-by-one error in Velocidex Velociraptor before version 0.76.5 on Windows and Linux causes denial of service when parsing specially crafted .evtx files through the parse_evtx VQL plugin. Local attackers with user-level privileges can crash the Velociraptor process by uploading or providing malformed event log files, disrupting forensic investigations and incident response operations. The vulnerability requires user interaction (file upload/selection) but grants an attacker both integrity and availability impact despite the CVSS 4.4 (Medium) rating.
Directory traversal in Rapid7 Velociraptor servers running on Linux before 0.75.6 lets a rogue enrolled client upload a file that is written outside the server's datastore directory, breaching the assumption that Velociraptor only writes within the datastore. The flaw stems from insufficient sanitization of directory names that end with a trailing dot, where only the final '.' is encoded as '%2E', but the impact is constrained because the containing directory must itself end in '%2E', which the vendor states prevents overwriting critical files. The vector (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N) reflects high attack complexity and integrity-only impact, EPSS is low at 0.56% (44th percentile), there is no KEV listing, and publicly available exploit code exists, so this is a genuine but constrained medium-severity issue rather than a high-urgency crisis.
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and update the configuration. This can lead to arbitrary command execution and endpoint takeover. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator' role).
Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Due to insufficient validation in the PE and OLE parsers in Rapid7's Velociraptor versions earlier than 0.6.8 allows attacker to crash Velociraptor during parsing of maliciously malformed files. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
A cross-site scripting (XSS) issue in generating a collection report made it possible for malicious clients to inject JavaScript code into the static HTML file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Due to a bug in the handling of the communication between the client and server, it was possible for one client, already registered with their own client ID, to send messages to the server claiming. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting (XSS) issue, where an authenticated user could abuse MIME filetype sniffing to embed. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity.
Privilege escalation in Rapid7 Velociraptor allows an authenticated user holding only the 'investigator' role to execute arbitrary VQL statements with administrator privileges on the Velociraptor server by populating the internal 'compiled_collector_args' field when submitting a hunt-creation/scheduling API request. Because the server accepts this internal field from the caller, the attacker-supplied pre-compiled VQL is trusted and the ACL checks that normally gate artifact compilation are skipped (CVSS 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exploitation requires a valid investigator-or-higher account that can schedule hunts, making this an insider/privilege-escalation path rather than an unauthenticated remote compromise; no public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status was provided. The vendor advisory is published at https://docs.velociraptor.app/announcements/advisories/cve-2026-19072/.
Template injection in Velociraptor's notebook backup restoration pipeline allows a low-privileged NOTEBOOK_EDITOR user to execute arbitrary VQL queries at elevated server-level permissions. The daily backup feature - enabled by default - captures notebook cell content verbatim; when an administrator later restores the backup, that content is interpolated into a Go template without ACL enforcement, breaking the privilege boundary between analyst and server roles. No public exploit has been identified at time of analysis, but the chained attack path (plant payload, wait for restore) represents a credible insider or compromised-analyst escalation vector against DFIR infrastructure.
Privilege escalation in Rapid7 Velociraptor lets any user permitted to schedule client monitoring artifacts run otherwise-restricted artifacts - including Linux.Sys.BashShell - to execute arbitrary commands on managed endpoints. The server enforced the EXECVE permission for scheduling command-execution artifacts through normal collection, but applied no equivalent permission or CLIENT_EVENTS-type check on the client monitoring path, so a low-privileged operator can bypass the gate entirely. No public exploit identified at time of analysis, though the upstream fix (PR #4967) makes the missing check straightforward to reconstruct.
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role - to overwrite global artifacts without the elevated permissions normally required for such operations. The `verify()` VQL function, designed only for syntax validation, incorrectly writes submitted artifacts into the shared global repository rather than a temporary local scope, effectively bypassing authorization controls (CWE-862). No public exploit or CISA KEV listing has been identified at time of analysis, but the low privilege bar and network accessibility make this a meaningful internal threat in Velociraptor deployments.
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, enabling a high-privileged attacker to inject javascript: URIs that execute when a second user clicks the crafted link in the console. The scope change (S:C) in the CVSS vector confirms the XSS crosses the application's security boundary into the victim's browser session, exposing session tokens and permitting authenticated actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis, but the C:H/I:H impact scores reflect meaningful credential theft and session hijacking potential within the Velociraptor investigation console.
Privilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIENT permission check and schedule new client collections, a capability normally restricted to the investigator role. The bypass is achieved by executing a VQL query that resets the authorization provider, collapsing the RBAC boundary between analyst and investigator roles. No public exploit has been identified at time of analysis, though the remediation commit is publicly visible on GitHub.
Account takeover in Rapid7 Velociraptor is possible when the platform is configured to use an external OIDC Identity Provider for authentication. Velociraptor maps OIDC email claims directly to internal usernames without validating the IdP's email_verified flag, enabling an attacker with any account on the same IdP to change their registered email address to match a target user's and seamlessly inherit that user's Velociraptor session and privileges. Given Velociraptor's role as a DFIR and endpoint monitoring platform, successful exploitation could expose sensitive forensic data, endpoint telemetry, and incident response artifacts. No public exploit code has been identified at time of analysis.
Path traversal in Velociraptor's NewNotebook API allows authenticated users holding NOTEBOOK_EDIT permission to write files outside the organization's designated data store directory. While the written file is constrained to the '.json.db' extension, this is sufficient to overwrite critical internal metadata files - including ACL records and hunt configurations - causing data corruption that can undermine the integrity of active forensic investigations. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires a valid authenticated session with a specific permission grant.
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any org in the deployment by exploiting a misplaced permission check. The server incorrectly validates the ORG_ADMIN permission against the caller's own child org rather than the ROOT org, and child org admins can self-grant this permission within their local ACL scope. An attacker with child org admin credentials can permanently delete peer orgs - including all their forensic artifacts, hunt data, and client configurations - well outside their authorized boundary.
Out-of-bounds read and memory exhaustion flaws in Velociraptor's NTFS parsing library allow denial of service when processing maliciously crafted NTFS images. Specifically affects deployments using the dead disk forensics workflow where Velociraptor ingests untrusted NTFS image files rather than live filesystems. An attacker who can supply a corrupted NTFS volume to a Velociraptor analyst can crash the tool, disrupting forensic investigations. No public exploit identified at time of analysis; patch available in version 0.77.2 and later.
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-privileged GUI user to impersonate any other user, including admins, by supplying a crafted 'Grpc-Metadata-USER' header, resulting in full account takeover. The flaw stems from the gRPC/GUI layer trusting a client-supplied identity header instead of the authenticated session. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the fix is trivial to reverse-engineer once the header name is known.
Cross-organization ACL disclosure in Velocidex Velociraptor before 0.76.5 allows any authenticated low-privilege user to enumerate the full role and permission policy of any user in any organization by abusing the GetUserRoles gRPC endpoint with attacker-chosen Name and Org parameters. The scope-changing flaw (CVSS 3.1 7.7, S:C) breaches tenant isolation in a DFIR platform where multi-org separation is a core trust boundary. No public exploit identified at time of analysis, and EPSS is very low (0.01%), so this is a confidentiality/reconnaissance issue rather than a code-execution or actively-exploited threat.
Multi-tenancy authorization bypass in Velociraptor before 0.76.3 allows authenticated GUI users to execute VQL queries against any organizational tenant using their current ACL token via the query() plugin in notebook cells. The user's permissions in the targeted org mirror those in the org where the notebook resides, meaning a high-privilege user in one org effectively gains equivalent access across all orgs. No public exploit has been identified at time of analysis, and EPSS is very low at 0.03% (8th percentile), though SSVC rates technical impact as total due to the unrestricted cross-org scope change.
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious messages to privileged internal queues via improper queue name validation. Affected versions prior to 0.76.2 (including 0.75.6, 0.74.6, and 0.76.1) are vulnerable to queue injection attacks from rogue authenticated clients. EPSS score of 0.20% (42nd percentile) suggests low broad exploitation probability, though SSVC framework indicates total technical impact despite no confirmed active exploitation. Vendor patch released as version 0.76.2.
Privilege-model bypass in Rapid7 Velociraptor's Windows.Sysinternals.SysmonLogForward artifact allows an authenticated operator who holds only the COLLECT_CLIENT permission (typically the built-in 'Investigator' role) to launch an arbitrary, attacker-chosen binary on monitored Windows endpoints instead of the installed Sysmon binary. Because the artifact exposes a user-controllable binary-path parameter and fails to enforce the additional EXECVE permission that gates comparable dangerous artifacts, successful collection results in code execution on the endpoint under the elevated privileges the artifact normally runs with, yielding high confidentiality, integrity, and availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Exploitation is not anonymous: the attacker must already be a trusted Velociraptor operator with artifact-collection rights, and the chosen binary must be reachable or placeable on the target endpoint, which narrows realistic exposure to insiders or compromised operator accounts. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue is a moderate, privilege-escalation class flaw rather than a mass-exploitation threat.
Incorrect authorization in Rapid7 Velociraptor allows an authenticated user with the LABEL_CLIENTS permission to alter server-wide metadata via the SetClientMetadata operation, which should be restricted to server administrators. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) and classified as CWE-863 (Incorrect Authorization), producing high integrity impact with no confidentiality or availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis; the primary risk is privilege escalation for insiders or compromised low-privilege accounts, with impact scaling to how broadly LABEL_CLIENTS is delegated in a given deployment.
Cross-tenant event-stream disclosure in Rapid7 Velociraptor lets an authenticated API user who holds event-watching privileges in one organization read WatchEvent gRPC streams belonging to a different organization they are not authorized for, because the server validates permissions against the caller's own OrgId instead of the OrgId supplied in the request. Only multi-org (multi-tenant) deployments with more than one Org defined are meaningfully exposed; single-org installs have no other tenant to pivot to, and the impact is confidentiality-only with no write or denial-of-service effect. Exploitation requires valid low-privileged API credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and no public exploit code was identified at time of analysis.
Authenticated users of Rapid7 Velociraptor can trigger a server-side deadlock in the platform's user-management module, hanging server operations and causing a denial of service (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Exploitation requires only a valid low-privileged account that can reach the user-management code path over the network - no user interaction, no elevated role, and no special configuration - but it offers no data read, modification, or code execution, so it cannot be used for initial access or lateral escalation. Impact is availability-only (CWE-833, lock management bug); no public exploit identified at time of analysis, no CISA KEV listing, and the vendor advisory is the authoritative source for version-specific guidance.
Parsing a malformed Windows prefetch file through Velociraptor's bundled prefetch library (Velocidex/go-prefetch) can trigger an out-of-bounds condition and crash the parsing operation, an availability-only impact with no data disclosure or code execution. The issue is local and interaction-dependent: exploitation requires that an attacker-supplied or corrupted .pf artifact reach a location the parser processes and that a user or agent run the parse, consistent with the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (the vendor-facing score of 3.6 rates it slightly higher with scope change and low integrity impact). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this is a genuinely low-priority defect that should be handled through routine dependency-update hygiene rather than emergency response.
Denial of service in Velociraptor allows any authenticated user - including those holding only the read-only reader role - to immediately terminate the entire server process with a single API call. By invoking SetPassword with a username that does not exist, an attacker triggers a null pointer dereference (CWE-476) that crashes the process, rendering the DFIR platform completely unavailable. No public exploit has been identified at time of analysis, but the trivially low exploitation barrier - any valid credential suffices - makes this a credible insider or compromised-account threat in any environment where Velociraptor is operationally depended upon.
Velociraptor's NTFS parsing library contains out-of-bounds read and memory exhaustion flaws that allow a crash and denial of service when processing maliciously crafted NTFS images. All versions of Rapid7's Velociraptor (cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*) are affected, with meaningful exposure limited to dead disk forensics workflows where untrusted NTFS images are ingested - live filesystem analysis is largely insulated from this attack path. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the local attack vector further constrains real-world exploitation opportunity.
Cross-organizational data exfiltration in Rapid7 Velociraptor's gRPC API allows authenticated ROOT org users to read datastore files belonging to other tenant organizations by bypassing the VFSGetBuffer endpoint's path prefix deny-list. The bypass undermines Velociraptor's multi-tenant isolation model, exposing sensitive DFIR artifacts - forensic evidence, endpoint memory, and investigation files - from organizations the attacker is not authorized to access. No public exploit code has been identified at time of analysis, and exploitation requires pre-existing high-privilege credentials in the ROOT organization.
Missing NETWORK ACL enforcement across Velociraptor's upload_azure, upload_sftp, upload_smb, upload_gcs, and related VQL plugins allows an authenticated analyst-role user to force the server to initiate outbound TCP connections to arbitrary attacker-controlled endpoints. This bypasses the intended NETWORK ACL permission boundary - a role separation control designed to prevent analysts from triggering server-side network activity - enabling port-oracle-based reconnaissance of the server's internal network segments and potential data exfiltration to external destinations. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is bounded by the requirement for analyst-role authentication.
Velociraptor versions prior to 0.76.4 allow authenticated users with reader role in the root organization to bypass cross-organization authorization controls via HTTP API GET requests, enabling them to read arbitrary files from other organizations regardless of their permissions in those target organizations. The vulnerability requires high privilege context (authenticated reader in root org) but has high confidentiality impact across organization boundaries. This is a horizontal privilege escalation affecting multi-tenant deployments where organizational isolation is a critical security boundary.
Off-by-one error in Velocidex Velociraptor before version 0.76.5 on Windows and Linux causes denial of service when parsing specially crafted .evtx files through the parse_evtx VQL plugin. Local attackers with user-level privileges can crash the Velociraptor process by uploading or providing malformed event log files, disrupting forensic investigations and incident response operations. The vulnerability requires user interaction (file upload/selection) but grants an attacker both integrity and availability impact despite the CVSS 4.4 (Medium) rating.
Directory traversal in Rapid7 Velociraptor servers running on Linux before 0.75.6 lets a rogue enrolled client upload a file that is written outside the server's datastore directory, breaching the assumption that Velociraptor only writes within the datastore. The flaw stems from insufficient sanitization of directory names that end with a trailing dot, where only the final '.' is encoded as '%2E', but the impact is constrained because the containing directory must itself end in '%2E', which the vendor states prevents overwriting critical files. The vector (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N) reflects high attack complexity and integrity-only impact, EPSS is low at 0.56% (44th percentile), there is no KEV listing, and publicly available exploit code exists, so this is a genuine but constrained medium-severity issue rather than a high-urgency crisis.
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and update the configuration. This can lead to arbitrary command execution and endpoint takeover. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator' role).
Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Due to insufficient validation in the PE and OLE parsers in Rapid7's Velociraptor versions earlier than 0.6.8 allows attacker to crash Velociraptor during parsing of maliciously malformed files. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plugin or artifact. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
A cross-site scripting (XSS) issue in generating a collection report made it possible for malicious clients to inject JavaScript code into the static HTML file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Due to a bug in the handling of the communication between the client and server, it was possible for one client, already registered with their own client ID, to send messages to the server claiming. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting (XSS) issue, where an authenticated user could abuse MIME filetype sniffing to embed. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity.