CVE-2026-64954Disclosure

LOWCVSS 8.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Full discourse1 post

ADK Cyber@ADKCyber46d
Disclosure
CVE-2026-64954 (CVSS 8.2): Velociraptor notebook VQL queries bypass COLLECT_CLIENT permission checks. Review notebook access if deployed. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/IIfa5QXbuD
Post summary
The tweet announces CVE‑2026‑64954, a high‑scoring vulnerability in Velociraptor that allows notebook VQL queries to bypass COLLECT_CLIENT permission checks; no PoC, exploit code, or patch is mentioned, but users are advised to review notebook access.
0000042
92 followersView on X

Explore more

Back to dashboard