CVEvulnerability

CVE-2026-64954

8.2 HIGH Published 2026-08-12 Modified 2026-10-24 Official page ↗
Status
Awaiting Analysis
Published
2026-08-12
Last modified
2026-10-24
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.2 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-862

Description

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role.

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References