CVE-2026-64954: 
Velociraptor vulnerability analysis and mitigation

CVE-2026-64954 is a missing authorization vulnerability in Rapid7's Velociraptor DFIR platform that allows authenticated users with the "analyst" role to escalate privileges and launch client collections normally restricted to the "investigator" role. The flaw affects all Velociraptor versions prior to 0.77.2 and was published on August 12, 2026. It carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, Feedly).

The root cause is CWE-862 (Missing Authorization): when a user executes a VQL query within a Velociraptor notebook, the query can reset the authorization provider, bypassing the COLLECT_CLIENT permission check that would normally gate new collection scheduling. The GetACLManager() function in artifacts/utils.go was updated in the fix to return an error rather than silently failing when the ACL manager is absent, preventing the authorization provider from being reset via VQL. An attacker must already have low-level authenticated access (analyst role) and the ability to run arbitrary VQL queries; no unauthenticated exploitation is possible (GitHub Commit, GitHub Advisory).

Successful exploitation allows an analyst-role user to escalate to investigator-level privileges and launch unauthorized data collections from managed clients, potentially exposing sensitive forensic data and endpoint artifacts. The scope is marked as "Changed" in the CVSS vector, meaning the impact extends beyond the directly vulnerable component to client endpoints under Velociraptor management. Confidentiality and integrity are both rated High, as an attacker could collect and potentially manipulate investigation data; availability is not impacted (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is approximately 0.23% (14th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated account with at least analyst-level access and the ability to execute arbitrary VQL queries, raising the practical bar for attackers (GitHub Advisory).

1. Gain Analyst Access: Obtain credentials for a Velociraptor account with the "analyst" role, which grants the ability to run VQL queries in notebooks but not to schedule new client collections.
2. Open a Notebook: Navigate to the Velociraptor web UI and open or create a notebook that allows arbitrary VQL query execution.
3. Craft a VQL Payload: Write a VQL query designed to reset or bypass the authorization provider within the current scope, exploiting the missing enforcement of the COLLECT_CLIENT permission check.
4. Execute the Query: Run the crafted VQL query in the notebook; the authorization provider is reset, removing the permission gate for collection scheduling.
5. Schedule Unauthorized Collection: With the authorization provider reset, issue a new collection request targeting one or more managed clients — an action that normally requires the "investigator" role — to collect forensic artifacts or sensitive endpoint data (GitHub Advisory, GitHub Commit).

• Logs: Velociraptor audit logs showing collection scheduling events (COLLECT_CLIENT actions) initiated by accounts holding only the analyst role; unexpected collection requests originating from notebook VQL execution sessions.
• Application Behavior: New hunt or collection objects created by analyst-role users in the Velociraptor datastore without a corresponding investigator-role authorization event.
• Network: API calls to Velociraptor's collection scheduling endpoints (e.g., ModifyHunt or equivalent gRPC/REST endpoints) from sessions authenticated as analyst-role users.
• VQL Query History: Notebook query history containing VQL referencing ACL manager reset functions or authorization provider manipulation, particularly queries that interact with ACL_MANAGER_VAR or scope-level permission objects (GitHub Commit).

Rapid7 has released Velociraptor version 0.77.2, which enforces the COLLECT_CLIENT permission check even when a VQL query attempts to reset the authorization provider. All users should upgrade to version 0.77.2 or later as the primary remediation. As a short-term workaround, restrict VQL query execution capabilities to trusted users only and audit existing analyst-role accounts to ensure none have been granted unnecessary permissions. Review Velociraptor audit logs for any unauthorized collection activity prior to patching (GitHub Advisory, GitHub Commit).