CVE-2026-19583: Velociraptor Auth Bypass Vulnerability

CVE-2026-19583 Overview

CVE-2026-19583 is an authorization bypass vulnerability in Velociraptor, the open-source endpoint monitoring and digital forensics platform maintained by Velocidex. Velociraptor gates certain sensitive artifacts behind additional permissions. For example, the Linux.Sys.BashShell artifact enables arbitrary command execution on endpoints and requires the EXECVE permission to schedule. The check was not enforced for client monitoring artifacts, and client monitoring artifacts were not required to carry the CLIENT_EVENTS type. Any user with permission to schedule client monitoring artifacts can therefore schedule otherwise restricted artifacts and execute arbitrary commands on managed endpoints. The flaw is tracked under [CWE-732: Incorrect Permission Assignment for Critical Resource].

Critical Impact
A low-privileged Velociraptor user with client monitoring scheduling rights can execute arbitrary commands across every managed endpoint, bypassing the EXECVE permission model.

Affected Products

Velociraptor endpoint monitoring and digital forensics server
Deployments where users can schedule client monitoring artifacts without holding EXECVE
See the Velociraptor Security Advisory CVE-2026-19583 for affected version ranges

Discovery Timeline

2026-09-10 - CVE-2026-19583 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-19583

Vulnerability Analysis

Velociraptor artifacts describe collection or monitoring logic that runs on endpoints. Sensitive artifacts that invoke shell execution, such as Linux.Sys.BashShell, require the EXECVE permission before they can be scheduled through standard collection workflows. This permission gate is the primary control preventing arbitrary command execution by lower-privileged console users.

The client monitoring subsystem, which pushes long-running event queries to endpoints, did not enforce the same permission check. A user authorized to schedule client monitoring artifacts could reference an artifact that normally requires EXECVE, and the server would deploy it to every connected client. The subsystem also did not verify that submitted artifacts carried the CLIENT_EVENTS type, so collection artifacts intended for one-off use could be scheduled as persistent monitoring rules.

Because client monitoring artifacts execute on every connected endpoint, exploitation results in fleet-wide arbitrary command execution under the Velociraptor client process, typically running with high privileges.

Root Cause

The root cause is a missing authorization check on the client monitoring artifact scheduling path, combined with the absence of a type constraint enforcing CLIENT_EVENTS. The server relied on the caller's monitoring permission and did not re-evaluate per-artifact permission gates such as EXECVE. This is a classic instance of [CWE-732], where a critical resource is exposed through an alternate code path with weaker permission enforcement.

Attack Vector

An authenticated user with client monitoring scheduling privileges submits a monitoring rule that references a sensitive artifact such as Linux.Sys.BashShell. The server accepts the rule without verifying EXECVE or the artifact type. Velociraptor then propagates the monitoring artifact to every enrolled client, where it executes the attacker-supplied command payload. Remediation details are available in GitHub Pull Request #4967.

Detection Methods for CVE-2026-19583

Indicators of Compromise

Client monitoring rules that reference artifacts normally gated by EXECVE, including Linux.Sys.BashShell or comparable shell-execution artifacts
Monitoring artifacts scheduled by users who do not hold the EXECVE permission in Velociraptor role assignments
Client-side execution of unexpected shell commands originating from the Velociraptor client process across many endpoints simultaneously

Detection Strategies

Audit the Velociraptor server's client monitoring configuration and compare scheduled artifacts against the list of artifacts that declare an EXECVE requirement
Review server audit logs for SetClientMonitoringState or equivalent RPCs invoked by non-admin users
Correlate endpoint process telemetry showing shell or interpreter spawns parented by the Velociraptor client agent with the timeframe of monitoring rule changes

Monitoring Recommendations

Enable and centrally forward Velociraptor server audit logs and alert on modifications to the client monitoring table
Baseline the set of artifacts included in client monitoring and alert on deviations, especially additions of collection-type artifacts
Monitor Velociraptor role assignments and flag grants of COLLECT_CLIENT or monitoring permissions to accounts that do not require them

How to Mitigate CVE-2026-19583

Immediate Actions Required

Upgrade the Velociraptor server to the fixed release identified in the Velociraptor Security Advisory CVE-2026-19583
Review current client monitoring rules and remove any artifacts that were not intentionally scheduled
Audit user roles and revoke client monitoring scheduling rights from accounts that do not require them

Patch Information

Velocidex addressed the issue in GitHub Pull Request #4967, which enforces per-artifact permission checks on the client monitoring scheduling path and requires monitoring artifacts to carry the CLIENT_EVENTS type. Administrators should deploy the fixed server build and restart the Velociraptor frontend to apply the change.

Workarounds

Restrict the roles that grant client monitoring scheduling permissions to trusted administrators only
Remove or restrict access to sensitive artifacts such as Linux.Sys.BashShell from the artifact repository until the server is patched
Enable strict audit logging and review monitoring rule changes on a short cadence until the upgrade completes

bash

# Example: list current client monitoring artifacts for review
velociraptor --config server.config.yaml query \
  "SELECT artifacts FROM client_monitoring()"