# CVE-2026-5329: Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client…

Source: https://junglewise.ai/threats/cve-2026-5329-rapid7-velociraptor-versions-prior-to-0-76-2-contain-an-improper  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09  
License: CC BY 4.0 with a link back

CVE-2026-5329 · Severity: high · CVSS 8.5 · Published 2026-04-09

Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring message handler on the Velociraptor server (primarily Linux) that allows an authenticated remote attacker  to write to arbitrary internal server queues via a crafted monitoring message with a malicious queue name. The server handler that receives client monitoring messages does not sufficiently validate the queue name supplied by the client, allowing a rogue client to write arbitrary messages to privileged internal queues. This may lead to remote code execution on the Velociraptor server. Rapid7 Hosted Velociraptor instances are not affected by this vulnerability.

Technologies: [Rapid7 Velociraptor](https://junglewise.ai/threats/technologies/rapid7-velociraptor). Vendors: [Rapid7](https://junglewise.ai/threats/vendors/rapid7).

## Quick answers

**Is CVE-2026-5329 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5329 being exploited in the wild.

**How severe is CVE-2026-5329?** High severity, with a CVSS score of 8.5, published 9 April 2026.

**Which products and versions are affected?** Rapid7 Velociraptor. The advisory does not name versions.

**Is there a fix for CVE-2026-5329?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-5329?** Check whether you run Rapid7 Velociraptor. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Rapid7 Velociraptor

## Related threats

- [Velociraptor privilege escalation via hunt compiled VQL](https://junglewise.ai/threats/cve-2026-19072-velociraptor-stores-the-compiled-vql-in-the-hunt-object)
- [Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token](https://junglewise.ai/threats/cve-2026-6290-velociraptor-vulnerability-in-the-query-plugin-which-allows-access)
- [Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue…](https://junglewise.ai/threats/cve-2025-14728-rapid7-velociraptor-versions-before-0-75-6-contain-a-directory)