Threats affecting pkg:github/github.com/Velocidex/velociraptor

CVE-2026-78413 is a medium severity vulnerability in Rapid7 Velociraptor versions before 0.77.3. It involves incorrect default permissions in the Windows.Sysinternals.SysmonLogForward artifact, which allows users with COLLECT_CLIENT permissions (typically the Investigator role) to specify an arbitrary binary path and execute a different binary than intended. This could lead to limited confidentiality, integrity, and availability impacts. Exploitation requires existing artifact collection permissions on the endpoint.

CVE-2026-78411 is a vulnerability in Rapid7 Velociraptor where the SetClientMetadata function uses an incorrect permission check. This flaw allows users with LABEL_CLIENTS permission to update server metadata, which is typically reserved for server administrators. Server metadata often contains site-wide configuration data, so unauthorized modification could impact system integrity. The vulnerability affects Velociraptor versions from initial releases up to but not including 0.77.3. The CVSS score is 6.5, indicating a medium severity level.

CVE-2026-78412 is an authorization bypass vulnerability in Rapid7 Velociraptor's WatchEvent gRPC API. The API allows specifying the OrgId to stream events from, but the server incorrectly checks permissions against the caller's organization rather than the requested one. This flaw enables a user with API access in one organization to read events from another organization without authorization. The vulnerability affects Velociraptor versions prior to 0.77.3. The CVSS score is 4.9, indicating medium severity.

Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.

Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiled_collector_args" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who can schedule a hunt (minimal role of "investigator" ) to set the compiled VQL statements for the hunt bypassing any ACL checks that would normally be applied. This flaw can then be escalated to allow the "investigator" user to run arbitrary VQL statements as an administrator user on the Velociraptor server.

CVE-2026-19584 is a vulnerability in Rapid7 Velociraptor affecting versions from 0 up to but not including 0.77.2. It involves improper neutralization of special elements in a template engine used during notebook backup restoration. A user with NOTEBOOK_EDITOR permission can inject a VQL query into notebook cell content, which is then evaluated with elevated permissions upon backup restoration.

CVE-2026-19583 is a critical vulnerability in Rapid7 Velociraptor versions before 0.77.2 involving incorrect permission assignment for sensitive artifacts. Specifically, client monitoring artifacts lacked proper permission checks, allowing users with scheduling rights for these artifacts to also schedule highly privileged artifacts like Linux.Sys.BashShell, which enables arbitrary command execution on endpoints. This flaw could lead to unauthorized privilege escalation and control over affected systems.

CVE-2026-19200 is a high-severity vulnerability in Rapid7 Velociraptor versions prior to 0.77.2. It involves a missing authorization check in the verify() VQL function, which allows users with NOTEBOOK_EDIT permission to overwrite existing artifacts in the global artifact repository without proper permissions. This flaw could lead to significant confidentiality, integrity, and availability impacts.

CVE-2026-15371 is a high-severity vulnerability in Rapid7 Velociraptor versions from 0 up to but not including 0.77.2. The web GUI allows users to specify a custom column type as a URL, but it does not restrict URL schemes. This flaw permits an attacker to use a JavaScript scheme, leading to a cross-site scripting (XSS) risk when users click the crafted URL in the GUI.

Velociraptor allows reading Stacked result sets from the GUI.  Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes. In particular, a user with read access to the root org can access result sets from child orgs.

A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process. The problem is a Divide by Zero bug in the ShouldPadFile() function.

The hunt_delete() VQL function allows deleting hunts.  Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "investigator" role) instead of the "DELETE_RESULTS" permission (usually only assigned to "administrators").

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution.  Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not clear if the vulnerability is actually in Microsoft Excel treating a CSV data file as executable content, or if Velociraptor should be sanitizing the data to prevent Excel from executing it. However, since this is such a common use case for Velociraptor we decided to highlight it in an advisory.

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role.

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email. This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files (such as ACL records, hunts etc). This can corrupt these files and cause data corruption.

Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORG_ADMIN permission on the ROOT org. This issue results from the Velociraptor server allowing for the deletion of Orgs by incorrectly checking the ORG_ADMIN permission of callers within the calling ORG instead of the ROOT org. However, Org admins of child orgs were able to add this permission to their ACL token within their own org. This allows an administrator in a child org, which is not also an administrator in the ROOT org, to delete other orgs.

Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typically Velociraptor's NTFS parser is used on live NTFS filesystems, limiting the opportunity of attackers corrupting the filesystem. However, in some applications (e.g.  dead disk forensics https://docs.velociraptor.app/docs/forensic/deaddisk/ ) Velociraptor may be used on untrusted NTFS image files.  If an attacker is able to inject maliciously corrupted NTFS Volumes they can cause a crash and a Denial of Service.