Rapid7 Velociraptor before version 0.76.2 contains an improper input validation vulnerability (CWE-20) in the client monitoring message handler on the server side. The server does not sufficiently validate the queue name provided by an authenticated client, allowing a malicious client to write arbitrary messages to privileged internal queues. This can potentially lead to remote code execution on the Velociraptor server. This vulnerability affects primarily Linux deployments of Velociraptor. Hosted Velociraptor services by Rapid7 are not impacted. The CVSS 3.1 score is 8.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

An authenticated remote attacker can exploit this vulnerability to write arbitrary messages to privileged internal server queues, potentially leading to remote code execution on the Velociraptor server. This compromises the confidentiality, integrity, and availability of the affected system. Rapid7 Hosted Velociraptor instances are not affected, limiting impact to self-hosted deployments prior to version 0.76.2.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor Rapid7 advisories for updates. Rapid7 Hosted Velociraptor instances are not affected, so no action is required for those environments.