Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are the same as the permissions they have in the org containing the notebook.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-16 | 1 | Disclosure1 |
| 2026-05-07 | 1 | General1 |
الحمدلله اكتشفت ثلاث ثغرات امنية في نظام @velocidex التابع الى @rapid7 CVE-2026-6290 CVE-2026-6863 CVE-2026-6948 https://t.co/vFKrGR0jCK
Post summary
A user reports discovering three CVEs in Velocidex but provides no technical details, PoC, or evidence of exploitation.
CVE-2026-6290 Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an au… https://www.cve.org/CVERecord?id=CVE-2026-6290
Post summary
CVE‑2026‑6290 is a vulnerability in Velociraptor’s query() plugin that permits an attacker to gain access to all organizations using the user’s ACL token, but no PoC, exploit code, patch, or active exploitation is reported.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | rapid7 | velociraptor | - | - | - |