CVE-2026-64954

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
http://docs.velociraptor.app/announcements/advisories/cve-2026-64954/
https://github.com/Velocidex/velociraptor/commit/d7de958e846d3742a7a3a8538fd463e4f12fc528

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Velociraptor permite programar nuevas colecciones a través de consultas VQL en cuadernos. Para que un usuario programe una nueva colección, requiere el permiso COLLECT_CLIENT. Sin embargo, esto no se aplica cuyo el usuario puede ejecutar una consulta VQL que restablece el proveedor de autorización. Esto permite a un usuario que puede ejecutar VQL arbitrario (normalmente con el rol de ’analista’) lanzar nuevas colecciones (normalmente requiere el rol de ’investigador’). Esta vulnerabilidad es una escalada de un rol de analista a investigador.

Information

Published : 2026-08-12 05:19

Updated : 2026-10-24 16:10

NVD link : CVE-2026-64954

Mitre link : CVE-2026-64954

CVE.ORG link : CVE-2026-64954

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-64954", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64954", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-13T15:10:40.534655Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@rapid7.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@rapid7.com", "affectedData": [{"repo": "https://github.com/Velocidex/velociraptor/", "vendor": "Rapid7", "product": "Velociraptor", "versions": [{"status": "affected", "version": "0", "lessThan": "0.77.2", "versionType": "semver"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-08-12T05:19:17.893", "references": [{"url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-64954/", "source": "cve@rapid7.com"}, {"url": "https://github.com/Velocidex/velociraptor/commit/d7de958e846d3742a7a3a8538fd463e4f12fc528", "source": "cve@rapid7.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@rapid7.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider.\n\nThis allows a user who can run arbitrary VQL (usually with the \"analyst\" role) to launch new collections (usually requires the \"investigator\" role). This vulnerability is an escalation from an analyst to investigator role."}, {"lang": "es", "value": "Velociraptor permite programar nuevas colecciones a trav\u00e9s de consultas VQL en cuadernos. Para que un usuario programe una nueva colecci\u00f3n, requiere el permiso COLLECT_CLIENT. Sin embargo, esto no se aplica cuyo el usuario puede ejecutar una consulta VQL que restablece el proveedor de autorizaci\u00f3n.\n\nEsto permite a un usuario que puede ejecutar VQL arbitrario (normalmente con el rol de \u2019analista\u2019) lanzar nuevas colecciones (normalmente requiere el rol de \u2019investigador\u2019). Esta vulnerabilidad es una escalada de un rol de analista a investigador."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "cve@rapid7.com"}