AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Rapid7CVE-2026-64952

Rapid7 Velociraptor: improper authorization

Rapid7

CVE-2026-64952 · Published Aug 12, 2026 · updated Aug 28, 2026

Medium6.5
Fix: upgrade to 0.77.2 or later
Rapid7 advisory

The hunt_delete() VQL function allows deleting hunts. 

Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "investigator" role) instead of the "DELETE_RESULTS" permission (usually only assigned to "administrators").

Affected versions

PackageAffectedFixed in
Velociraptor
Product
< 0.77.20.77.2
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-863

More Rapid7 advisories

All Rapid7
Low 3.5Aug 12A rogue Velociraptor client can upload a malformed sparse file suchCVE-2026-64951fixed in 0.77.2Medium 6.1Aug 12Rapid7 Velociraptor: CSV injectionCVE-2026-64955fixed in 0.77.2Medium 6.5Aug 12Rapid7 Velociraptor: missing authorizationCVE-2026-18652fixed in 0.77.2High 8.2Aug 12Rapid7 Velociraptor: missing authorizationCVE-2026-64954fixed in 0.77.2Medium 6.5Aug 11Rapid7 Velociraptor: null pointer dereferenceCVE-2026-18638fixed in 0.77.2High 7.3Aug 11Rapid7 Velociraptor: authentication bypass by spoofingCVE-2026-18639fixed in 0.77.2