What’s Vulnerable › Vulnerabilities

CVE-2026-19584: Velociraptor VQL injection during notebook restore from backup

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-10 · updated 2026-09-11
• Weakness: CWE-94

Description

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query which will be evaluated at elevated permissions if the notebook's backup is subsequently restored.

Affected products

• Rapid7 Velociraptor: before 0.77.2 — fixed in 0.77.2

How to fix

Upgrade to a fixed version: Rapid7 Velociraptor 0.77.2. Check the vendor advisory for mitigations.

References

• http://docs.velociraptor.app/announcements/advisories/cve-2026-19584/
• https://github.com/Velocidex/velociraptor/pull/4967

Get alerted when CVE-2026-19584 or the next vulnerability affects your stack