Vulnerability · Published Apr 15, 2026 · Assigned by rapid7
CVE-2026-6290Velociraptor Query() Plugin Misapplies Permissions To Orgs
High 8.0
In plain English
A high-severity incorrect authorization in Velociraptor from Rapid7. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Official description
Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are the same as the permissions they have in the org containing the notebook.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | www.velocidex.com/golang/velociraptor | no fix listed | GHSA-hv5g-26jg-pc45 |
| Go | www.velocidex.com/golang/velociraptor | no fix listed | GO-2026-5438 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rapid7 | Velociraptor | 0 – before 0.76.3, 0.75.8 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H