CVE-2026-19584

HIGH 7.7

Velociraptor VQL injection during notebook restore from backup

CVSS Score

7.7

EPSS Score

0.0%

EPSS Percentile

0th

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query which will be evaluated at elevated permissions if the notebook's backup is subsequently restored.

CWE	CWE-1336 CWE-94
Vendor	rapid7
Product	velociraptor
Published	Sep 10, 2026
Last Updated	Sep 11, 2026

Stay Ahead of the Next One

Get instant alerts for rapid7 velociraptor

Be the first to know when new high vulnerabilities affecting rapid7 velociraptor are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

Rapid7 / Velociraptor

0 < 0.77.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

docs.velociraptor.app: http://docs.velociraptor.app/announcements/advisories/cve-2026-19584/ github.com: https://github.com/Velocidex/velociraptor/pull/4967

Credits

Yuval Miller Leon Kayaliev