velociraptor

Velociraptor - Endpoint visibility and collection tool. Velociraptor is a tool for collecting host based state information using The Velociraptor Query Language VQL queries. To learn more about Velociraptor, read the documentation on: https://docs.velociraptor.app/ Quick start If you want to see...

CVE-2026-64954: Missing Authorization

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run...

EUVD-2026-22995

Velociraptor versions prior to 0.76.3 contain a vulnerability in the query plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query plugin, in a notebook cell, to run VQL queries on other orgs which th...

Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token

Velociraptor versions prior to 0.76.3 contain a vulnerability in the query plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query plugin, in a notebook cell, to run VQL queries on other orgs which th...

CVE-2026-6290

Velociraptor versions prior to 0.76.3 contain a vulnerability in the query plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query plugin, in a notebook cell, to run VQL queries on other orgs which th...

CVE-2026-6290: Incorrect Authorization

Velociraptor versions prior to 0.76.3 contain a vulnerability in the query plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query plugin, in a notebook cell, to run VQL queries on other orgs which th...

PT-2026-33112

Name of the Vulnerable Software and Affected Versions Velociraptor versions prior to 0.76.3 Description A flaw in the query plugin allows an authenticated GUI user to access all organizations using their current ACL token. By utilizing the query plugin within a notebook cell, a user with access t...