Improper Input Validation in Rapid7 Velociraptor Server
CVE-2026-5329

8.5HIGH

Key Information:

Vendor

Rapid7

Status
Velociraptor
Vendor
CVE Published:
9 April 2026

What is CVE-2026-5329?

Rapid7 Velociraptor versions before 0.76.2 exhibit a vulnerability due to insufficient input validation in the client monitoring message handler on Linux servers. This flaw enables authenticated remote attackers to write arbitrary messages to internal server queues through maliciously crafted monitoring messages. Due to the lack of proper validation for the queue name provided by clients, an attacker could exploit this weakness, potentially leading to unauthorized access and remote code execution on the server. Rapid7 Hosted Velociraptor instances remain unaffected by this issue.

Affected Version(s)

Velociraptor Linux 0 <= 0.76.1

Velociraptor Linux 0 <= 0.75.6

Velociraptor Linux 0 <= 0.74.6

References

https://docs.velociraptor.app/announcements/advisories/cv...

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

We thank Chris Au (@netero_1010) from NyxLab for identifying and reporting this issue.
.