Executive brief
Velociraptor is a digital forensics and incident response platform that allows administrators to collect data from endpoints and schedule forensic artifact collection. A flaw in the permission model allowed users without the necessary administrative privileges to bypass security restrictions and execute sensitive artifacts (such as arbitrary shell commands) by scheduling them through client monitoring queries instead of normal collection workflows.
Technical details
Velociraptor enforces permission checks on certain high-risk artifacts (e.g., Linux.Sys.BashShell) that require the EXECVE permission to schedule, preventing unauthorized command execution. However, no equivalent permission checks were applied to client monitoring artifacts, and client monitoring artifacts were not required to carry the CLIENT_EVENTS type. An attacker with permission to schedule client monitoring artifacts could therefore bypass the EXECVE permission requirement and schedule restricted artifacts for execution on endpoints. The vulnerability was patched by enforcing required permissions validation on SetClientMonitoringState() operations.
Affected products
- Velocidex Velociraptor prior to 0.77.2
Timeline
- 2026-09-10: disclosed
- 2026-08-10: patched: Fix merged in PR #4967