Remote Code Execution Risk in Velociraptor Due to Insufficient Access Control
CVE-2026-19584

7.7HIGH

Key Information:

Vendor

Rapid7

Status
Velociraptor
Vendor
CVE Published:
10 September 2026

What is CVE-2026-19584?

Velociraptor's default daily backup feature for notebook creation lacks adequate access control checks during restoration. This design flaw enables a user with NOTEBOOK_EDITOR permission to inject a potentially harmful VQL query. If an attacker restores the compromised backup, the query can be executed with elevated privileges, posing a significant security risk. Organizations using Velociraptor should review their backup practices and apply the necessary patches to mitigate this vulnerability effectively.

Affected Version(s)

Velociraptor Linux 0 < 0.77.2

References

http://docs.velociraptor.app/announcements/advisories/cve...
vendor-advisory
https://github.com/Velocidex/velociraptor/pull/4967
patch

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yuval Miller
Leon Kayaliev
.