🚨 [DFIR / CRITICAL FLAW] — RAPID7 VELOCIRAPTOR GETS A CVSS 9.9 PERMISSION-BYPASS CVE. CVE-2026-19583 can let a lower-privileged investigator schedule restricted artifacts capable of arbitrary endpoint commands. Priority: 🔴 VERY HIGH 1/8 🧵 2/8 Velociraptor is used for endpoint visibility, threat hunting and DFIR. The issue is dangerous because its permission model normally gates sensitive artifacts. Example: Linux.Sys.BashShell requires EXECVE because it can run arbitrary commands on endpoints. 3/8 Rapid7 says client-monitoring artifacts did NOT enforce the same permission check. An investigator able to add a client-monitoring artifact could therefore schedule an otherwise restricted artifact such as: Linux.Sys.BashShell. 4/8 Potential path: Investigator-level account ↓ Add client-monitoring artifact ↓ Permission check bypassed ↓ Restricted artifact scheduled ↓ Commands executed on endpoints CVSS 3.1: 9.9 CRITICAL User interaction: NONE 5/8 Affected: Rapid7 Velociraptor on Linux versions BEFORE 0.77.2. The same release also fixes CVE-2026-19584, a separate VQL injection issue involving notebook backups and restore operations. That second flaw scores 7.7 HIGH. 6/8 CVE-2026-19584 works differently: Notebook editor plants VQL ↓ Notebook enters backup ↓ Backup is later restored ↓ Cell content is interpolated without ACL checks ↓ VQL executes with elevated permissions Restore/user interaction is required. 7/8 ⚠️ Caveat: These are NOT unauthenticated internet-to-RCE bugs. CVE-2026-19583 requires at least investigator access. The vendor had documented the issues earlier; the formal CVE records were published September 10. No CISA KEV listing is shown currently. 8/8 🛡️ Defender action: → Upgrade to Velociraptor 0.77.2+ → Review investigator privileges → Audit client-monitoring artifacts → Inspect backups before restoration CyberSignal Insight: Your security platform's permission model is itself part of the attack surface.
Post summary
The post details a critical permission-bypass flaw in Rapid7 Velociraptor, provides actionable patch and remediation steps, and does not report any active exploitation or PoC code.
