CVE-2026-64954 in Velociraptor
Summary
by MITRE • 08/12/2026
Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider.
This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability represents a critical privilege escalation flaw within the Velociraptor security orchestration platform that undermines the intended access control model. The system implements role-based permissions where different user roles have distinct capabilities, with the analyst role typically allowing read-only access and analysis capabilities while the investigator role grants more extensive permissions including the ability to schedule new collections. The core technical flaw occurs in the authorization enforcement mechanism when users can execute VQL queries that reset or bypass the authorization provider, effectively circumventing the COLLECT_CLIENT permission requirement that should prevent analysts from scheduling new collections.
The operational impact of this vulnerability is significant as it allows attackers with minimal privileges to escalate their access level within the system. An attacker who has been granted the analyst role can leverage their ability to execute arbitrary VQL queries to manipulate the authorization context, thereby gaining access to functionality that should be restricted to users with the investigator role. This creates a dangerous situation where users with limited access can potentially expand their capabilities to include full collection scheduling, which could enable them to gather sensitive data from targeted endpoints without proper authorization.
The vulnerability manifests through the improper enforcement of permission checks within the VQL execution environment, specifically when certain VQL functions or operations reset the authorization context. This behavior violates fundamental security principles and creates an attack surface where privilege boundaries can be crossed through legitimate query execution paths. The flaw aligns with CWE-284 (Improper Access Control) and represents a classic case of insufficient authorization checking that allows users to perform actions beyond their assigned permissions.
From a threat modeling perspective, this vulnerability maps directly to ATT&CK technique T1078.004 (Valid Accounts: Cloud Accounts) and T1566 (Phishing) as it enables attackers who have gained access with low-privilege accounts to escalate their capabilities through legitimate system functionality. The attack path relies on the attacker having access to VQL execution capabilities, typically through analyst roles or compromised credentials that allow query execution against the platform.
Mitigation strategies should focus on implementing stricter authorization enforcement mechanisms that prevent VQL queries from resetting authorization contexts and ensuring that all collection scheduling operations require proper permission validation regardless of execution context. Organizations should implement additional monitoring for suspicious VQL execution patterns and consider implementing more granular access controls that separate the ability to execute queries from the ability to perform privileged operations. The system should enforce mandatory access control policies that prevent any user, regardless of their role or query execution capabilities, from bypassing permission checks for critical functions like collection scheduling.
Security teams should also implement comprehensive logging and alerting around unauthorized collection scheduling attempts, as well as regular audits of VQL query execution patterns to detect potential exploitation attempts. The vulnerability highlights the importance of maintaining consistent authorization enforcement across all system components and preventing query execution contexts from inadvertently weakening security boundaries that are designed to protect sensitive operational capabilities within security orchestration platforms.