CVE-2026-19072
CriticalCVSS 9.9Summary
Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiled_collector_args" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who can schedule a hunt (minimal role of "investigator") to set the compiled VQL statements for the hunt bypassing any ACL checks that would normally be applied. This flaw can then be escalated to allow the "investigator" user to run arbitrary VQL statements as an administrator user on the Velociraptor server.
Risk Assessment
A user with the "investigator" role can execute arbitrary VQL statements with administrator privileges on the Velociraptor server. This can lead to full server compromise and breach of all managed endpoints.
Recommendation
Update Velociraptor to a version containing the fix. Limit the number of users with the "investigator" role and check logs for unusual hunts.
Other vulnerabilities in Velociraptor
See all- CVE-2026-77798Medium
Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.
- CVE-2026-77797Low
Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.
- CVE-2026-19583Critical
Velociraptor allows some sensitive artifacts to be gated by additional permissions, e.g. Linux.Sys.BashShell requires EXECVE. However, no such check was implemented for client monitoring artifacts, and there was no requirement that they carry the CLIENT_EVENTS type. This allows any user who can schedule client monitoring artifacts to also schedule otherwise restricted artifacts.
- CVE-2026-19584High
Velociraptor creates notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query that will be evaluated at elevated permissions if the notebook's backup is subsequently restored.
- CVE-2026-19200High
The Velociraptor verify() VQL function allows a user to verify an artifact for syntactic and other issues. Due to an implementation fault, the global artifact repository is used, allowing callers to overwrite existing artifacts without the required permissions. The attacker only needs NOTEBOOK_EDIT permission (e.g., an analyst role) to call this function.
- CVE-2026-15371High
Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI. The code does not limit the schemes allowed in this URL, allowing an attacker to specify a JavaScript scheme exposing the user to XSS.
- CVE-2026-64955Medium
Velociraptor fails to sanitize data when exporting to CSV, which can lead to formula execution by Microsoft Excel during import. Cells starting with certain characters are treated as formulas, allowing arbitrary code execution.
- CVE-2026-64952Medium
The hunt_delete() VQL function in Velociraptor allows deleting hunts. Velociraptor misapplied the permission check, requiring only COLLECT_CLIENT (usually assigned to the 'investigator' role) instead of the DELETE_RESULTS permission (usually only assigned to administrators).
- CVE-2026-64951Low
A rogue Velociraptor client can upload a malformed sparse file that causes a panic when the GUI attempts to expand it, potentially crashing the server process. The issue is a Divide by Zero bug in the ShouldPadFile() function.
- CVE-2026-18652Medium
Velociraptor allows reading Stacked result sets from the GUI due to incorrect path validation against the prefix deny list. A user with read access to the root org can access result sets from child orgs.
Original NVD description (English source)
Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiled_collector_args" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who can schedule a hunt (minimal role of "investigator" ) to set the compiled VQL statements for the hunt bypassing any ACL checks that would normally be applied. This flaw can then be escalated to allow the "investigator" user to run arbitrary VQL statements as an administrator user on the Velociraptor server.