CVE-2026-19200 Overview
CVE-2026-19200 is a code injection vulnerability in the Velociraptor digital forensics and incident response platform. The verify() VQL (Velociraptor Query Language) function contains an implementation flaw that references the global artifact repository. This allows callers to overwrite existing artifacts without holding the required permissions. An attacker only needs the NOTEBOOK_EDIT permission, typically granted to analyst roles, to abuse the function. Successful exploitation lets a low-privileged user modify server-side artifact definitions, enabling further code execution paths within the platform. The vulnerability is tracked under CWE-94: Improper Control of Generation of Code.
Critical Impact
An analyst-role user with NOTEBOOK_EDIT permission can overwrite arbitrary Velociraptor artifacts, undermining the platform's authorization model and enabling privilege escalation.
Affected Products
- Velociraptor DFIR platform (see Velociraptor Security Advisory CVE-2026-19200)
- Deployments exposing the notebook interface to non-administrative users
- Multi-tenant Velociraptor servers with analyst-role accounts
Discovery Timeline
- 2026-08-24 - CVE-2026-19200 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-19200
Vulnerability Analysis
Velociraptor exposes VQL as the primary query and automation language for endpoint collection. The verify() function is intended to validate an artifact definition for syntactic correctness and other structural issues before use. The function was implemented to operate against the global artifact repository rather than a scoped or read-only copy. As a result, the verification path can mutate stored artifact definitions.
An attacker holding only NOTEBOOK_EDIT permission can invoke verify() from a notebook cell. By supplying an artifact payload with a name matching an existing artifact, the caller overwrites the trusted definition. Subsequent executions of that artifact then run attacker-controlled VQL, extending the compromise to any user or scheduled job that references the artifact.
Root Cause
The root cause is missing authorization enforcement inside the verify() VQL function. Velociraptor gates artifact modification behind higher-privileged roles, but the verification code path does not perform the corresponding permission check before writing to the global repository. This is a classic [CWE-94] code injection pattern where trusted execution context accepts attacker-controlled artifact definitions.
Attack Vector
Exploitation requires an authenticated session with NOTEBOOK_EDIT rights and user interaction to trigger the crafted query. The attacker authors a notebook that calls verify() with a malicious artifact definition reusing the name of a legitimate artifact. When the query runs, the global repository entry is replaced. Any operator who later executes the overwritten artifact runs the attacker's VQL with that operator's privileges. Full technical details are documented in Velociraptor Pull Request #4962.
Detection Methods for CVE-2026-19200
Indicators of Compromise
- Notebook queries invoking the verify() VQL function with an inline artifact parameter that redefines an existing artifact name.
- Unexpected changes to server-side artifact definitions timestamped outside of normal administrator maintenance windows.
- Artifact execution logs showing new external network calls, process launches, or file writes originating from previously benign artifacts.
Detection Strategies
- Audit Velociraptor server logs for VQL statements containing verify( submitted by non-administrator accounts.
- Diff current artifact definitions against a known-good baseline stored outside the Velociraptor server.
- Alert on modifications to built-in artifact namespaces such as Server.*, Windows.*, Linux.*, and Generic.* performed by analyst-role users.
Monitoring Recommendations
- Ship Velociraptor audit logs to a centralized logging platform and correlate notebook activity with artifact repository writes.
- Track the ratio of verify() calls per user; sudden spikes from analyst roles warrant investigation.
- Review notebook contents authored by users with NOTEBOOK_EDIT permission for embedded artifact YAML payloads.
How to Mitigate CVE-2026-19200
Immediate Actions Required
- Upgrade Velociraptor to the fixed release identified in the vendor advisory.
- Review the current set of accounts holding NOTEBOOK_EDIT permission and revoke it where not operationally required.
- Validate that server-side artifact definitions match the expected upstream or organization-approved versions.
Patch Information
The fix is implemented in Velociraptor Pull Request #4962, which corrects the verify() function so that verification no longer targets the global artifact repository and enforces the appropriate permission check before any artifact modification. Administrators should apply the vendor-supplied release that incorporates this pull request.
Workarounds
- Restrict NOTEBOOK_EDIT permission to trusted operators until the patched version is deployed.
- Disable or limit access to notebook features for analyst-tier roles on internet-exposed Velociraptor servers.
- Monitor artifact repository integrity with periodic hash comparisons against a signed baseline.
# Configuration example
# List users and their assigned roles to identify accounts with NOTEBOOK_EDIT
velociraptor --config server.config.yaml acl show <username>
# Revoke the analyst role from a user pending patch deployment
velociraptor --config server.config.yaml acl grant <username> --role reader
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
