CVE-2026-7573: Velocidex Velociraptor authorization bypass in GetUserRoles API

CVE-2026-7573 · Severity: medium · CVSS 5 · Published 2026-05-06

Velociraptor, an open-source endpoint monitoring and digital forensics platform, contains a security flaw in its internal communication system. An attacker with basic user access can bypass security checks to view the specific permissions and roles assigned to any other user across the entire organization. While this does not grant direct control over other accounts, it allows an attacker to identify high-privilege targets for further specialized attacks.

Technologies: www.velocidex.com/golang/velociraptor (Go), Linux Kernel, Velocidex Velociraptor. Vendors: Go, Linux, Velocidex.

Quick answers

Is CVE-2026-7573 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-7573 being exploited in the wild.
How severe is CVE-2026-7573?
Medium severity, with a CVSS score of 5, published 6 May 2026.
Which products and versions are affected?
www.velocidex.com/golang/velociraptor (Go) < 0.76.5, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.76.5; Velocidex Velociraptor < 0.76.5.
Is there a fix for CVE-2026-7573?
Yes. www.velocidex.com/golang/velociraptor (Go): upgrade to 0.76.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7573 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-7573?
Check whether you run www.velocidex.com/golang/velociraptor (Go), Linux Kernel or Velocidex Velociraptor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • www.velocidex.com/golang/velociraptor (Go): upgrade to 0.76.5 or later
    go get www.velocidex.com/golang/velociraptor@v0.76.5

Technical details

An authorization bypass (CWE-639) exists in the GetUserRoles gRPC API endpoint of Velocidex Velociraptor. The vulnerability is rooted in insufficient validation of user-controlled 'Name' and 'Org' parameters during API requests. A network-based attacker with low-level authenticated access can supply targeted parameters to retrieve the complete Access Control List (ACL) policy, including roles and permissions, for any user across all organizations. While the attacker must know the target's organization ID and username, the exploit allows for the enumeration of high-privilege accounts. The issue is resolved in version 0.76.5.

Affected products

  • Velocidex Velociraptor < 0.76.5

Identifiers

  • CVE-2026-7573
  • GHSA-3c93-g9g6-p5j4
  • GO-2026-5078

Timeline

  • 2026-05-04: advisory: Vendor advisory published by Rapid7/Velociraptor
  • 2026-05-06: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.