Rapid7 Velociraptor
38 CVEs affecting Rapid7 Velociraptor. Latest disclosed: 2026-09-10. Critical: 2, High: 13.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-19583 | Critical | 9.9 | 2026-09-10 | Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command exec… |
CVE-2026-18972 | Critical | 9.6 | 2026-08-11 | An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an acc… |
CVE-2026-19200 | High | 8.9 | 2026-08-24 | The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function… |
CVE-2023-0242 | High | 8.8 | 2023-01-18 | Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any command on the server i… |
CVE-2026-18860 | High | 8.7 | 2026-08-11 | Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants withi… |
CVE-2023-5950 | High | 8.6 | 2023-11-06 | Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into… |
CVE-2026-5329 | High | 8.5 | 2026-04-09 | Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring message handler on the Velociraptor se… |
CVE-2026-64954 | High | 8.2 | 2026-08-12 | Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permissio… |
CVE-2026-15371 | High | 8.1 | 2026-08-18 | Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI… |
CVE-2026-6290 | High | 8.0 | 2026-04-15 | Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This all… |
CVE-2026-8795 | High | 7.8 | 2026-06-09 | A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostname field in client_i… |
CVE-2026-19584 | High | 7.7 | 2026-09-10 | Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell… |
CVE-2026-18639 | High | 7.3 | 2026-08-11 | When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email… |
CVE-2026-18635 | High | 7.2 | 2026-08-11 | Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling… |
CVE-2026-18640 | High | 7.1 | 2026-08-11 | The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record out… |
CVE-2026-18636 | Medium | 6.8 | 2026-08-11 | The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing… |
CVE-2026-6863 | Medium | 6.8 | 2026-05-06 | Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organizat… |
CVE-2025-14728 | Medium | 6.8 | 2025-12-29 | Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written ou… |
CVE-2026-64952 | Medium | 6.5 | 2026-08-12 | The hunt_delete() VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "in… |
CVE-2026-18652 | Medium | 6.5 | 2026-08-12 | Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requ… |