CVE-2026-19584: 
Velociraptor vulnerability analysis and mitigation

CVE-2026-19584 is a code injection / template injection vulnerability in Rapid7's Velociraptor DFIR platform that allows a privilege escalation attack via malicious notebook backups. An authenticated user with the NOTEBOOK_EDITOR permission can plant a malicious VQL (Velociraptor Query Language) query inside a notebook cell; when an administrator later restores a backup, the cell content is interpolated into a template without ACL checks, causing the query to execute at elevated privileges. All Velociraptor versions prior to 0.77.2 are affected. The vulnerability was published on September 10, 2026, and carries a CVSS v3.1 base score of 7.7 (High) (Github Advisory, Feedly).

The root cause is improper neutralization of special elements used in a template engine (CWE-1336) combined with improper control of code generation (CWE-94): notebook cell content supplied by a low-privileged user is directly interpolated into a Go template during backup restoration without sanitization or permission re-evaluation. Velociraptor's daily backup feature (enabled by default) serializes notebook cells into backup archives; upon restoration, the server processes these cells as trusted template input, bypassing the ACL model entirely. The fix, merged in pull request #4967, explicitly prevents template escapes when restoring notebooks from backups and enforces required permissions on client monitoring artifacts (GitHub PR #4967, Github Advisory).

Successful exploitation allows an authenticated attacker with only NOTEBOOK_EDITOR permission to execute arbitrary VQL queries at the elevated privilege level of the restoring administrator, achieving a scope change that affects components beyond the attacker's own security context. This can result in high confidentiality impact (access to sensitive investigation data, collected artifacts, and credentials stored in Velociraptor) and high integrity impact (modification of hunts, artifacts, or client configurations), while availability is not directly affected. Because Velociraptor is a DFIR and endpoint-monitoring platform with broad access to managed endpoints, privilege escalation within it could facilitate lateral movement to monitored hosts (Github Advisory, Feedly).

No public proof-of-concept exploit code and no evidence of in-the-wild exploitation have been reported as of the publication date (Feedly). The EPSS score is 0.0, reflecting a very low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated account with NOTEBOOK_EDITOR permission and depends on an administrator subsequently triggering a backup restoration (user interaction required), which raises the attack complexity (Github Advisory).

1. Obtain NOTEBOOK_EDITOR access: Authenticate to the Velociraptor server with an account that holds the NOTEBOOK_EDITOR permission (e.g., a low-privileged analyst account).
2. Create or edit a notebook: Navigate to the Notebooks section and create or open an existing notebook.
3. Inject malicious VQL payload: Insert a crafted VQL query into a notebook cell that, when evaluated at elevated privileges, performs a sensitive action — for example, exfiltrating server secrets, modifying artifact definitions, or issuing commands to managed endpoints. The payload exploits the lack of template escaping during restoration.
4. Wait for or trigger backup: Velociraptor's daily backup feature (enabled by default) will automatically archive the notebook, including the malicious cell content, into a backup file.
5. Social engineering or timing: Wait for an administrator to restore the backup (e.g., after a server migration or disaster recovery event), or attempt to convince an administrator to perform a restore.
6. Payload executes at elevated privileges: During restoration, the server interpolates the notebook cell content into a template without ACL checks, causing the injected VQL query to execute with the permissions of the restoring process, achieving privilege escalation (GitHub PR #4967, Github Advisory).

• Logs: Velociraptor server audit logs showing notebook edits by low-privileged NOTEBOOK_EDITOR accounts shortly before a backup was taken; unexpected VQL execution events logged during a backup restoration operation.
• File System: Backup archive files (.zip or similar) containing notebook cells with unusual or obfuscated VQL queries referencing sensitive artifacts, server configuration, or remote execution plugins.
• Process/Behavior: Unexpected VQL queries executing during backup restoration that access artifacts or permissions beyond the originating user's normal scope; server-side actions (e.g., artifact modifications, new hunt creation, client tasking) initiated during a restore operation with no corresponding administrator intent.
• Network: Outbound connections from the Velociraptor server to unexpected external hosts initiated during or immediately after a backup restoration, potentially indicating data exfiltration via a VQL http_client() call embedded in the malicious notebook cell.

Upgrade Velociraptor to version 0.77.2 or later, which includes the fix from PR #4967 that prevents template escapes during notebook backup restoration and enforces ACL checks on client monitoring artifacts (GitHub PR #4967, Velociraptor Advisory). As interim workarounds: restrict the NOTEBOOK_EDITOR permission to fully trusted users only; disable the default daily backup feature if it is not operationally required; and carefully review notebook cell content for suspicious VQL before performing any backup restoration. Monitor and audit all backup restoration activities for anomalous query execution.

The vulnerability was assigned by Rapid7 and disclosed via the GitHub Advisory Database and the official Velociraptor documentation site on September 10, 2026. Social media activity was limited to automated CVE notification accounts on Bluesky and Mastodon shortly after publication, with no notable independent researcher commentary or broader media coverage observed (Feedly).