by Kastro
Paper/Archive/CVE-2026-6290

CVE-2026-6290

Rapid7 Velociraptor — Velociraptor Query() Plugin Misapplies Permissions To Orgs

EPSS 0.2%CVSS 9.1
critical.is priorityof 100
30
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 13.1.131 × 202.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are the same as the permissions they have in the org containing the notebook.

Affected

ProductAffectedFixed inSource
Velociraptor< 0.76.3, 0.75.80.76.3, 0.75.8CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
rapid7 (CNA)8.0CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refdocs.velociraptor.app/announcements/advisories/cve-2026-6290