CVE-2026-64954: Velociraptor collect_client() Permissions Bypass
Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECTCLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider.
This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64954?
The severity of CVE-2026-64954 is high, rated at 8.2.
How do I fix CVE-2026-64954?
To fix CVE-2026-64954, ensure that the COLLECT_CLIENT permission is properly enforced for users running VQL queries.
What type of vulnerability is CVE-2026-64954?
CVE-2026-64954 is a permissions bypass vulnerability in Velociraptor.
What can an attacker do with CVE-2026-64954?
An attacker can schedule new collections in Velociraptor without the necessary COLLECT_CLIENT permission by exploiting this vulnerability.
Which software is affected by CVE-2026-64954?
The vulnerability CVE-2026-64954 affects Velociraptor.