CVE-2026-64952: Velociraptor Hunt Deletion With Insufficient Permission Check
The huntdelete() VQL function allows deleting hunts.
Velociraptor misapplied the permission check requiring only COLLECTCLIENT (usually assigned to the "investigator" role) instead of the "DELETERESULTS" permission (usually only assigned to "administrators").
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64952?
The severity of CVE-2026-64952 is medium with a score of 6.5.
How do I fix CVE-2026-64952?
To fix CVE-2026-64952, ensure that the proper permissions, specifically 'DELETE_RESULTS', are assigned to users who need to delete hunts in Velociraptor.
What types of permission checks are misapplied in CVE-2026-64952?
CVE-2026-64952 misapplies permission checks by allowing deletion with only the 'COLLECT_CLIENT' permission instead of the necessary 'DELETE_RESULTS' permission.
Which function is affected by CVE-2026-64952?
The hunt_delete() VQL function is affected by CVE-2026-64952, allowing unauthorized deletion of hunts.
What software is impacted by CVE-2026-64952?
The software impacted by CVE-2026-64952 is Velociraptor.