CVE-2026-5329

{"id": "CVE-2026-5329", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5329", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-09T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@rapid7.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@rapid7.com", "affectedData": [{"repo": "https://github.com/Velocidex/velociraptor", "vendor": "Rapid7", "product": "Velociraptor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.76.3"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.75.6"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.74.6"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-04-09T18:17:04.253", "references": [{"url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-5329/", "tags": ["Vendor Advisory"], "source": "cve@rapid7.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@rapid7.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Rapid7 Velociraptor versions prior to 0.76.2\u00a0contain an improper input validation vulnerability in the client monitoring message handler on the Velociraptor server (primarily Linux) that allows an authenticated remote attacker to write to arbitrary internal server queues via a crafted monitoring message with a malicious queue name. The server handler that receives client monitoring messages\u00a0does not sufficiently validate the queue name supplied by the client, allowing a rogue client to write arbitrary messages to privileged internal queues. This may lead to remote code execution on the Velociraptor server. Rapid7 Hosted Velociraptor instances are not affected by this vulnerability."}, {"lang": "es", "value": "Las versiones de Rapid7 Velociraptor anteriores a la 0.76.2 contienen una vulnerabilidad de validaci\u00f3n de entrada inadecuada en el gestor de mensajes de monitorizaci\u00f3n del cliente en el servidor de Velociraptor (principalmente Linux) que permite a un atacante remoto autenticado escribir en colas internas arbitrarias del servidor a trav\u00e9s de un mensaje de monitorizaci\u00f3n manipulado con un nombre de cola malicioso. El gestor del servidor que recibe los mensajes de monitorizaci\u00f3n del cliente no valida suficientemente el nombre de la cola proporcionado por el cliente, permitiendo que un cliente malicioso escriba mensajes arbitrarios en colas internas privilegiadas. Esto puede conducir a la ejecuci\u00f3n remota de c\u00f3digo en el servidor de Velociraptor. Las instancias de Rapid7 Hosted Velociraptor no se ven afectadas por esta vulnerabilidad."}], "lastModified": "2026-10-26T00:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BAC49A9C-FD09-45D6-9493-5DA3AFF9E3AD", "versionEndIncluding": "0.75.6"}, {"criteria": "cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35A554F9-5926-43C1-B906-BDB41CB36CB3", "versionEndExcluding": "0.76.3", "versionStartIncluding": "0.76"}], "operator": "OR"}]}], "sourceIdentifier": "cve@rapid7.com"}