SQL Injection Vulnerability in Velociraptor Tool by Velocidex

CVE-2026-85737

What is CVE-2026-85737?

A vulnerability in the Velociraptor tool allows for SQL injection due to improper enforcement of permission checks in the SQLPlugin.Call function. This issue arises in versions before 0.77.2, wherein the lack of plugin-level FILESYSTEM_READ and NETWORK checks allows an attacker to exploit MySQL connection options. As a result, a rogue MySQL server can request sensitive files read by the Velociraptor server process, exposing critical data. While the SQLite file accessor does enforce necessary checks, a low-privilege user can still create files without restrictions, potentially leading to further escalation of privileges. The issue has been addressed in version 0.77.2.

References