Velociraptor implements permission gating for sensitive artifacts such as Linux.Sys.BashShell, which requires EXECVE permission to schedule due to its ability to execute arbitrary commands on endpoints. However, this permission check was not applied to client monitoring artifacts, nor was there a requirement for these artifacts to carry the CLIENT_EVENTS type. This flaw enables any user authorized to schedule client monitoring artifacts to bypass restrictions and schedule otherwise restricted artifacts, leading to potential arbitrary command execution on endpoints.

An attacker with the ability to schedule client monitoring artifacts can escalate privileges to schedule and execute sensitive artifacts like Linux.Sys.BashShell, resulting in full command execution on endpoints. This can lead to complete compromise of affected systems, including confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict scheduling permissions to trusted users only and monitor scheduling activities closely to prevent unauthorized artifact execution.