Rapid7CVE-2026-19584

Rapid7 Velociraptor: code injection

CVE-2026-19584 · Published Sep 10, 2026 · updated Sep 11, 2026

High7.7

Fix: upgrade to 0.77.2 or later

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query which will be evaluated at elevated permissions if the notebook's backup is subsequently restored.

Affected versions

Package	Affected	Fixed in
Velociraptor Product	< 0.77.2	0.77.2

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-94, CWE-1336

More Rapid7 advisories

All Rapid7

High 7.8Sep 24

Rapid7 Insight Agent: code executionCVE-2026-89325no fix yet Medium 6.5Sep 24

Velociraptor contains a deadlock conditionCVE-2026-77798fixed in 0.77.2 Low 3.6Sep 24

Rapid7 Velociraptor: improper input validationCVE-2026-77797fixed in 0.77.3 Critical 9.9Sep 24

Velociraptor stores the compiled VQL in the hunt object internally to avoid...CVE-2026-19072fixed in 0.77.2 Critical 9.9Sep 10

Rapid7 Velociraptor: insecure permissionsCVE-2026-19583fixed in 0.77.2 Medium 5.1Aug 27

A logic vulnerabilityCVE-2026-16895fixed in 6.5.2