Rapid7 Velociraptor versions before 0.76.2 contain an input validation vulnerability (CWE-20) in the client monitoring message handler. The server does not properly validate the queue name supplied by authenticated clients, enabling them to write arbitrary data to internal privileged queues. This improper input validation can be leveraged by a remote attacker with authentication to achieve remote code execution on the server. The vulnerability is specific to self-hosted Velociraptor servers, with Rapid7's hosted service unaffected. The CVSS v3.1 score is 8.5, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

An authenticated remote attacker can exploit this vulnerability to write arbitrary messages to privileged internal queues on the Velociraptor server, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected server. Rapid7 Hosted Velociraptor instances are not impacted, limiting the scope to self-hosted deployments. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, users should monitor Rapid7 advisories for updates. Rapid7 Hosted Velociraptor instances are not affected, so no action is required for those environments.