VulnerabilityAwaiting Analysis

CVE-2026-64954

Velociraptor allows scheduling new collections via VQL queries in notebooks.

HIGH 8.2EPSS 0.23%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role.

CVSS 3.1: 8.2 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
EPSS: 0.23% probability · 14th percentile
CISA KEV: Not listed
Weakness: CWE-862
Source: cve@rapid7.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.