CVE-2026-19584 Overview
CVE-2026-19584 affects Velociraptor, an open-source endpoint monitoring and digital forensics platform. The vulnerability resides in the default-enabled daily notebook backup feature. When Velociraptor restores a backup, the notebook cell content is interpolated into a template without Access Control List (ACL) checks. A user holding the NOTEBOOK_EDITOR permission can plant a Velociraptor Query Language (VQL) query that later executes at elevated permissions when the backup is restored. This maps to CWE-94: Improper Control of Generation of Code.
Critical Impact
A low-privileged notebook editor can achieve code execution at elevated privileges by planting VQL that runs during the automated backup restore process.
Affected Products
- Velociraptor endpoint monitoring and digital forensics platform
- Deployments with the default-enabled daily notebook backup feature
- Installations granting NOTEBOOK_EDITOR permission to non-administrative users
Discovery Timeline
- 2026-09-10 - CVE-2026-19584 published to the National Vulnerability Database (NVD)
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-19584
Vulnerability Analysis
Velociraptor persists notebook contents through a daily backup routine that is enabled by default. When an administrator or automated process restores a backup, the server re-hydrates each notebook by interpolating stored cell content into a template. The restore path skips the ACL checks that normally gate notebook execution. This allows attacker-authored VQL to reach the evaluator under the identity that triggers the restore, typically a server or administrative context.
The issue is a code injection flaw rather than a memory-safety bug. Malicious content is treated as executable template input during restore, breaking the trust boundary between authoring and execution.
Root Cause
The root cause is missing authorization enforcement during template interpolation of backup content. Notebook cells are trusted as safe template fragments even though their authors may only hold NOTEBOOK_EDITOR rights. There is no re-check of the original author's permissions before the VQL executes under the restoring principal.
Attack Vector
Exploitation requires an authenticated user with NOTEBOOK_EDITOR permission and user interaction from an administrator to trigger a restore. The attacker plants a crafted VQL payload inside a notebook cell. When the daily backup is later restored, the payload evaluates with the elevated privileges of the restore operation. This can lead to arbitrary VQL execution, disclosure of sensitive artifacts, and modification of server-side state. Refer to the Velociraptor Security Advisory and GitHub Pull Request #4967 for the technical fix.
Detection Methods for CVE-2026-19584
Indicators of Compromise
- Notebook cells containing unusual VQL constructs, template directives, or references to server-side artifacts unrelated to the notebook's stated purpose.
- Backup restore events followed by unexpected VQL execution, artifact collection, or credential access in server logs.
- New or modified notebooks authored by accounts holding only NOTEBOOK_EDITOR permission that contain administrative queries.
Detection Strategies
- Audit notebook cell content for template metacharacters and VQL functions that touch privileged artifacts or the file system.
- Correlate backup restore timestamps with VQL execution logs to identify queries running under elevated identities.
- Track permission grants for NOTEBOOK_EDITOR and flag principals who authored cells later executed during restore.
Monitoring Recommendations
- Enable verbose audit logging for the notebook subsystem and the backup restore workflow.
- Ship Velociraptor server logs to a centralized analytics platform and alert on restore operations outside change windows.
- Review notebook diffs before every scheduled restore to detect planted VQL payloads.
How to Mitigate CVE-2026-19584
Immediate Actions Required
- Upgrade Velociraptor to the release containing the fix from GitHub Pull Request #4967.
- Review all accounts holding NOTEBOOK_EDITOR permission and revoke access that is not strictly required.
- Inspect existing notebooks for suspicious VQL before performing any backup restore.
Patch Information
The Velociraptor maintainers addressed the flaw upstream. See the Velociraptor Security Advisory for fixed version details and the GitHub Pull Request #4967 for the code changes that enforce ACL checks during backup restore.
Workarounds
- Disable the daily notebook backup feature until the patched version is deployed.
- Restrict NOTEBOOK_EDITOR permission to trusted administrators only.
- Manually review notebook contents in the backup archive before triggering a restore operation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
