Rapid7CVE-2026-19200

Rapid7 Velociraptor: code injection

CVE-2026-19200 · Published Aug 24, 2026 · updated Aug 28, 2026

High8.9

Fix: upgrade to 0.77.2 or later

The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker need only have the NOTEBOOK_EDIT permission (e.g. an analyst role) to be able to call this function.

Affected versions

Package	Affected	Fixed in
Velociraptor Product	< 0.77.2	0.77.2

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-94, CWE-862

More Rapid7 advisories

All Rapid7

Medium 5.1Aug 27

A logic vulnerabilityCVE-2026-16895fixed in 6.5.2 High 8.1Aug 18

Rapid7 Velociraptor: cross-site scriptingCVE-2026-15371fixed in 0.77.2 Low 3.5Aug 12

A rogue Velociraptor client can upload a malformed sparse file suchCVE-2026-64951fixed in 0.77.2 Medium 6.5Aug 12

Rapid7 Velociraptor: improper authorizationCVE-2026-64952fixed in 0.77.2 Medium 6.1Aug 12

Rapid7 Velociraptor: CSV injectionCVE-2026-64955fixed in 0.77.2 Medium 6.5Aug 12

Rapid7 Velociraptor: missing authorizationCVE-2026-18652fixed in 0.77.2