CVE-2026-19200

The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker need only have the NOTEBOOK_EDIT permission (e.g. an analyst role) to be able to call this function.

CVSS v3 8.9 HIGH

8.9^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
http://docs.velociraptor.app/announcements/advisories/cve-2026-19200/
https://github.com/Velocidex/velociraptor/pull/4962

Configurations

No configuration.

History

12 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) La función VQL verify() de Velociraptor permite a un usuario verificar un artefacto en busca de problemas sintácticos y de otra índole. Debido a un fallo de implementación en esta función VQL, se utiliza el repositorio global de artefactos, lo que permite a quienes la invocan sobrescribir artefactos existentes sin los permisos requeridos. El atacante solo necesita tener el permiso NOTEBOOK_EDIT (por ejemplo, un rol de analista) para poder invocar esta función.

Information

Published : 2026-08-24 04:16

Updated : 2026-10-12 16:10

NVD link : CVE-2026-19200

Mitre link : CVE-2026-19200

CVE.ORG link : CVE-2026-19200

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-862

Missing Authorization

{"id": "CVE-2026-19200", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19200", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-24T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@rapid7.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.9, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "cve@rapid7.com", "affectedData": [{"repo": "https://github.com/Velocidex/velociraptor/", "vendor": "Rapid7", "product": "Velociraptor", "versions": [{"status": "affected", "version": "0", "lessThan": "0.77.2", "versionType": "semver"}], "platforms": ["Linux", "Windows"], "packageName": "Velociraptor", "defaultStatus": "unaffected"}]}], "published": "2026-08-24T04:16:46.557", "references": [{"url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-19200/", "source": "cve@rapid7.com"}, {"url": "https://github.com/Velocidex/velociraptor/pull/4962", "source": "cve@rapid7.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@rapid7.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions.\u00a0 The attacker need only have the NOTEBOOK_EDIT permission (e.g. an analyst role) to be able to call this function."}, {"lang": "es", "value": "La funci\u00f3n VQL verify() de Velociraptor permite a un usuario verificar un artefacto en busca de problemas sint\u00e1cticos y de otra \u00edndole. Debido a un fallo de implementaci\u00f3n en esta funci\u00f3n VQL, se utiliza el repositorio global de artefactos, lo que permite a quienes la invocan sobrescribir artefactos existentes sin los permisos requeridos. El atacante solo necesita tener el permiso NOTEBOOK_EDIT (por ejemplo, un rol de analista) para poder invocar esta funci\u00f3n."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "cve@rapid7.com"}