CVE-2026-64954
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Velociraptor allows scheduling new collections via VQL queries in notebooks. The COLLECT_CLIENT permission is required, but it is not enforced when the user can run a VQL query that resets the authorization provider. A user with the analyst role can launch new collections, which usually require the investigator role, leading to privilege escalation.
Risk Assessment
Unauthorized collection scheduling could lead to uncontrolled data gathering or other actions that should be restricted to higher roles.
Recommendation
Upgrade Velociraptor to a version that properly enforces COLLECT_CLIENT permissions and restrict the ability to run arbitrary VQL queries.
Original NVD description (English source)
Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role.