CVE-2026-78411: 
Velociraptor vulnerability analysis and mitigation

CVE-2026-78411 is an incorrect authorization vulnerability in Rapid7's Velociraptor endpoint visibility and DFIR platform. The SetClientMetadata function applies the wrong permission check, allowing any authenticated user holding the LABEL_CLIENTS permission to modify server-wide metadata that should be restricted to server administrators. All Velociraptor versions prior to 0.77.3 are affected. The vulnerability was published on October 5, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is an incorrect authorization check (CWE-863) in Velociraptor's SetClientMetadata API function. Instead of verifying that the caller holds the appropriate server-admin-level permission before writing server metadata, the function mistakenly validates against the LABEL_CLIENTS permission — a lower-privilege role intended for labeling client endpoints. An authenticated, low-privileged user can exploit this over the network with no user interaction required by invoking SetClientMetadata with arbitrary key-value pairs, overwriting site-wide configuration data stored in server metadata (GitHub Advisory).

Successful exploitation allows an authenticated user with LABEL_CLIENTS permission to tamper with server-wide configuration data that is normally restricted to Velociraptor server administrators. Because server metadata can govern site-wide operational settings, unauthorized modifications could alter hunting behavior, notification endpoints, or other platform-wide parameters, compromising the integrity of the DFIR/EDR platform. There is no confidentiality or availability impact; the risk is limited to high integrity impact within the scope of the Velociraptor server (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and technical impact as "partial." The EPSS score is approximately 0.174% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Authenticate: Log in to the Velociraptor server GUI or API with any account that has been granted the LABEL_CLIENTS permission.
2. Identify the API endpoint: Locate the SetClientMetadata VQL function or equivalent API call available to authenticated users.
3. Craft a malicious request: Invoke SetClientMetadata with a target of the server metadata store (rather than a specific client), supplying arbitrary key-value pairs intended to overwrite site-wide configuration settings.
4. Submit the request: Because the permission check incorrectly validates LABEL_CLIENTS instead of a server-admin permission, the server accepts and applies the changes.
5. Achieve objective: The attacker's chosen metadata values are now stored as server-wide configuration, potentially altering platform behavior such as notification targets, hunt parameters, or other admin-controlled settings (GitHub Advisory).

• Logs: Velociraptor audit logs showing SetClientMetadata calls originating from accounts with LABEL_CLIENTS permission targeting server-level metadata keys rather than specific client IDs.
• Configuration: Unexpected or unauthorized changes to server metadata key-value pairs, particularly those governing site-wide settings (e.g., notification URLs, hunt configurations).
• User Activity: Low-privileged user accounts performing metadata write operations that would normally only appear in administrator activity logs.

Rapid7 has released Velociraptor version 0.77.3, which corrects the permission check in SetClientMetadata to require the appropriate server-admin permission. Organizations should upgrade to version 0.77.3 or later immediately. As an interim workaround, restrict assignment of the LABEL_CLIENTS permission to only fully trusted users, and audit server metadata for any unauthorized changes made by non-admin accounts (GitHub Advisory, Velociraptor Advisory).

The Canadian Centre for Cyber Security (CCCS) published a security advisory (AV26-1004) referencing this vulnerability shortly after disclosure (CCCS Advisory). The vulnerability was also noted in the Malware News aggregator (Malware News). No significant researcher commentary or social media discussion has been observed beyond standard vulnerability tracking.