CVE-2026-78411: Velociraptor Server Metadata update with Insufficient Permission Check
Published Oct 5, 2026
·Updated
Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABELCLIENTS permission to update the server metadata.
Server metadata is often used to store site wide configuration data that should only be updated by the server admin.
Affected Software
1 affected component
Velocidex Velociraptor
Event History
Oct 5, 2026
CVE Published
via MITRE·05:19 PM
Data Sourced
via MITRE·05:19 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A user who has the LABEL_CLIENTS permission can exploit it. They do not need server-administrator permission to update server metadata.
2
What is the practical impact of successful exploitation?
An attacker can modify server metadata, which is often used to store site-wide configuration data. This can compromise the integrity of configuration that should be controlled only by a server administrator.
3
Is unauthenticated access enough to exploit the issue?
No. The affected operation requires an authenticated user with the LABEL_CLIENTS permission.