CVE-2026-19200: Velociraptor Analyst overwrites live built-in artifacts through verify()
The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker need only have the NOTEBOOKEDIT permission (e.g. an analyst role) to be able to call this function.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any user with the NOTEBOOK_EDIT permission can exploit it. This includes users assigned an analyst role, if that role grants NOTEBOOK_EDIT.
What does an attacker need to do to exploit it?
The attacker needs authenticated access with NOTEBOOK_EDIT permission and must be able to invoke the verify() VQL function. No additional artifact-modification permission is required.
What is the impact of successful exploitation?
An attacker can overwrite existing live built-in artifacts in the global artifact repository. This can affect confidentiality, integrity, and availability across the affected security scope.