CVE-2026-19584

High

Description

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query which will be evaluated at elevated permissions if the notebook's backup is subsequently restored.

SeverityHigh

CVSS7.7

Exploit probability—

ProductVelociraptor

PublishedSep 10, 2026

First seenSep 10, 2026

Weakness typeCWE-1336CWE-1336 CWE-94Code injection

How to fix

Update

Rapid7 Velociraptor0.77.2 or later

Patches

github.com/Velocidex/velociraptor/pull/4967

Affected products

Product	Affected versions	Fixed in
Rapid7 Velociraptor	v < 0.77.2	0.77.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.