Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-19583

Velociraptor Required Permissions bypass by using client monitoring queries

CVSS 3.1 9.9 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-19583

Published

Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring artifacts. Additionally there was no requirement that client monitoring artifacts carry the CLIENT_EVENTS type. This allows any user who can schedule client monitoring artifacts to also schedule otherwise restricted artifacts (such as Linux.Sys.BashShell).

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-19583

Published

Velociraptor

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Rapid7",
                    "product": "Velociraptor",
                    "platforms": [
                        "Linux"
                    ],
                    "repo": "https://github.com/Velocidex/velociraptor",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "0.77.2",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON