CVE-2026-19584High· 7.7▾ TwilightVelociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a mali…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.3%
Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query which will be evaluated at elevated permissions if the notebook's backup is subsequently restored.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-19583Critical· 9.9Velociraptor Required Permissions bypass by using client monitoring queries
CVE-2026-78413Medium· 5.5Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints
CVE-2026-78411Medium· 6.5Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server
CVE-2026-78412Medium· 4.9Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed
CVE-2026-77797Low· 3.6Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.
CVE-2026-77798Medium· 6.5Velociraptor contains a deadlock condition that may be triggered by authenticated users