CVE-2026-64952: 
Velociraptor vulnerability analysis and mitigation

CVE-2026-64952 is an incorrect authorization vulnerability in Rapid7's Velociraptor digital forensics and incident response (DFIR) platform. The hunt_delete() VQL function misapplies its permission check, requiring only the COLLECT_CLIENT permission (typically assigned to the "investigator" role) rather than the DELETE_RESULTS permission (typically restricted to administrators), allowing lower-privileged users to delete hunts they should not be able to. All Velociraptor versions prior to 0.77.2 are affected. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-863 (Incorrect Authorization): Velociraptor's hunt_delete() VQL function performs an authorization check, but checks for the wrong permission (COLLECT_CLIENT) instead of the required DELETE_RESULTS permission. Since COLLECT_CLIENT is broadly assigned to the "investigator" role, any authenticated investigator-level user can invoke hunt_delete() over the network without additional interaction, bypassing the intended administrative restriction. No public proof-of-concept or detailed technical write-up beyond the vendor advisory is currently available (GitHub Advisory, Velociraptor Advisory).

An authenticated user with the investigator role (holding COLLECT_CLIENT permission) can delete any hunt in Velociraptor, an action that should be restricted to administrators with DELETE_RESULTS permission. This results in a high integrity impact — forensic hunt data and results can be permanently destroyed by unauthorized users — potentially undermining active investigations or enabling evidence tampering. There is no confidentiality or availability impact identified (GitHub Advisory, Feedly).

No public proof-of-concept exploit code exists, and there is no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is approximately 0.299% (22nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires valid credentials with at least investigator-level access, limiting the attack surface to authenticated internal users (GitHub Advisory).

1. Authenticate: Log in to the Velociraptor server with an account that has the "investigator" role (i.e., COLLECT_CLIENT permission).
2. Access VQL interface: Navigate to the Velociraptor notebook or query interface where VQL (Velociraptor Query Language) can be executed.
3. Identify target hunt: Enumerate existing hunts using a VQL query such as SELECT HuntId FROM hunts() to identify the hunt ID to be deleted.
4. Invoke hunt_delete(): Execute the VQL function SELECT hunt_delete(hunt_id='<HuntId>') targeting the desired hunt. Due to the misconfigured permission check, the server accepts this request from an investigator-level user without requiring administrator privileges.
5. Hunt deleted: The targeted hunt and its associated results are permanently removed from the Velociraptor server (GitHub Advisory, Velociraptor Advisory).

• Logs: Velociraptor audit logs showing hunt_delete() VQL function calls executed by accounts with the "investigator" role rather than administrator accounts; unexpected hunt deletion events in the server audit trail.
• Application Activity: Sudden disappearance of hunts or hunt results not initiated by an administrator; VQL notebook activity from investigator-role accounts invoking hunt_delete().
• User Behavior: Investigator-role accounts executing VQL queries beyond their expected scope, particularly any query referencing hunt_delete() (GitHub Advisory).

Rapid7 has released Velociraptor version 0.77.2, which correctly enforces the DELETE_RESULTS permission check for the hunt_delete() VQL function. Organizations should upgrade to version 0.77.2 or later as the primary remediation. As a temporary workaround prior to patching, restrict the COLLECT_CLIENT permission to only highly trusted users, or implement additional access controls to prevent investigator-role accounts from accessing the hunt_delete() function (Velociraptor Advisory, GitHub Advisory).