CVE-2026-19072: rapid7 velociraptor

Vulnerability summary

CVE-2026-19072 is a critical (CVSS 9.9) vulnerability in rapid7 velociraptor. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.8% of scored vulnerabilities.

Timeline

1. 24-09-2026
   PublishedVulnerability first disclosed.
2. 25-09-2026
   Last modifiedVulnerability information updated.

Description

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiled_collector_args" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who can schedule a hunt (minimal role of "investigator" ) to set the compiled VQL statements for the hunt bypassing any ACL checks that would normally be applied. This flaw can then be escalated to allow the "investigator" user to run arbitrary VQL statements as an administrator user on the Velociraptor server.

• CWE-164Improper Neutralization of Internal Special ElementsThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes internal special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
• CWE-1269Product Released in Non-Release ConfigurationThe product released to market is released in pre-production or manufacturing configuration.