Vulnerability · Published Sep 10, 2026 · Assigned by rapid7

CVE-2026-19583Velociraptor Required Permissions bypass by using client monitoring queries

Critical 9.9

In plain English

A critical-severity incorrect permission assignment in Velociraptor from Rapid7. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.6%top 51.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring artifacts. Additionally there was no requirement that client monitoring artifacts carry the CLIENT_EVENTS type. This allows any user who can schedule client monitoring artifacts to also schedule otherwise restricted artifacts (such as Linux.Sys.BashShell).

Affected products (as reported)

Vendor	Product	Versions
Rapid7	Velociraptor	0 – before 0.77.2

Weakness: CWE-732 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

References

Velociraptor Advisory CVE-2026-19583 vendor-advisory
Velociraptor Fix PR #4967 patch