CVE-2026-19583: Velociraptor Required Permissions bypass by using client monitoring queries
Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring artifacts. Additionally there was no requirement that client monitoring artifacts carry the CLIENTEVENTS type. This allows any user who can schedule client monitoring artifacts to also schedule otherwise restricted artifacts (such as Linux.Sys.BashShell).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict which users can schedule client monitoring artifacts, because the material states that an attacker who can schedule client monitoring artifacts can schedule otherwise restricted artifacts (e.g., Linux.Sys.BashShell) via a Required Permissions bypass.
Event History
Frequently Asked Questions
Which users should be treated as able to exploit this issue?
Any user who can schedule client monitoring artifacts should be considered capable of exploiting the bypass. The issue lets those users schedule artifacts that would otherwise require additional permissions, including artifacts requiring EXECVE.
What is the practical impact of the missing client-monitoring validation?
Client monitoring could be used to schedule sensitive artifacts without their required permission checks. The affected artifacts were also not required to have the CLIENT_EVENTS type, allowing otherwise restricted artifacts to be scheduled through client monitoring.