Velocidex Velociraptor up to 0.77.1 SQL Plugin vql/parsers/sql/sql.go SQLPlugin.Call connstring permission

Summaryinfo

A vulnerability was found in Velocidex Velociraptor up to 0.77.1. It has been declared as critical. The affected element is the function SQLPlugin.Call of the file vql/parsers/sql/sql.go of the component SQL Plugin. Executing a manipulation of the argument connstring can lead to permission. This vulnerability is registered as CVE-2026-85737. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Velocidex Velociraptor up to 0.77.1 and classified as critical. This vulnerability affects the function SQLPlugin.Call of the file vql/parsers/sql/sql.go of the component SQL Plugin. The manipulation of the argument connstring with an unknown input leads to a permission vulnerability. The CWE definition for the vulnerability is CWE-275. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Velociraptor is a tool for collecting host-based state information using Velociraptor Query Language (VQL) queries. Prior to 0.77.2, SQLPlugin.Call in vql/parsers/sql/sql.go does not enforce plugin-level FILESYSTEM_READ or NETWORK checks before the mysql and postgres branches pass a caller-controlled connstring to sql.Open, allowing arbitrary outbound database connections. With attacker-controlled MySQL connection options that enable local-infile access, a rogue MySQL server can request files readable by the Velociraptor server process, including root-readable files when that process runs as root. The SQLite file accessor still enforces FILESYSTEM_READ, but a low-privilege analyst with ANY_QUERY can use the zero-permission data accessor and ATTACH DATABASE to create files without the plugin-level check. This issue is fixed in version 0.77.2.

The advisory is available at github.com. This vulnerability was named CVE-2026-85737 since 09/04/2026. The exploitation appears to be easy. The attack can be initiated remotely. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1222 by the MITRE ATT&CK project.

Upgrading to version 0.77.2 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Velocidex

Name

• Velociraptor

Version

• 0.77.0
• 0.77.1

Website

• Product: https://github.com/Velocidex/velociraptor/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion