CVE-2026-5329: Rapid7 Velociraptor RCE Vulnerability

CVE-2026-5329 Overview

CVE-2026-5329 is an improper input validation vulnerability [CWE-20] in Rapid7 Velociraptor versions prior to 0.76.2. The flaw resides in the client monitoring message handler on the Velociraptor server, primarily affecting Linux deployments. An authenticated remote attacker can write to arbitrary internal server queues by submitting a crafted monitoring message containing a malicious queue name. The server handler fails to validate the queue name supplied by the client, allowing a rogue client to inject messages into privileged internal queues. Exploitation may lead to remote code execution on the Velociraptor server. Rapid7 Hosted Velociraptor instances are not affected.

Critical Impact
Authenticated attackers can write to privileged internal server queues, potentially achieving remote code execution on Velociraptor servers used for digital forensics and incident response.

Affected Products

Rapid7 Velociraptor versions prior to 0.76.2 (Linux deployments primarily)
Self-hosted Velociraptor server installations
Rapid7 Hosted Velociraptor is NOT affected

Discovery Timeline

2026-04-09 - CVE-2026-5329 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-5329

Vulnerability Analysis

Velociraptor is an endpoint visibility and digital forensics tool that uses a client-server architecture. Clients send monitoring messages to the server, which routes them to internal processing queues. The server-side handler that receives these client monitoring messages does not sufficiently validate the queue name supplied by the client. This allows an authenticated client to specify arbitrary queue names, including privileged internal queues reserved for server-side operations. By writing crafted messages into privileged queues, an attacker can influence trusted server-side processing logic. The vulnerability is tracked under [CWE-20: Improper Input Validation].

Root Cause

The root cause is missing validation of the queue name field in client monitoring messages. The server trusts client-supplied routing metadata without enforcing an allowlist of permitted queue destinations. This violates the principle of treating client input as untrusted, particularly in a system where clients may be compromised or rogue endpoints.

Attack Vector

Exploitation requires network access and valid client authentication to the Velociraptor server. An attacker controlling a rogue or compromised Velociraptor client constructs a monitoring message containing a queue name targeting an internal privileged queue. The server processes the message and routes it to the attacker-specified destination, where it is consumed by privileged handlers. This can escalate into remote code execution on the Velociraptor server itself.

No public proof-of-concept code is currently available. Refer to the Velociraptor Security Advisory CVE-2026-5329 for further technical detail.

Detection Methods for CVE-2026-5329

Indicators of Compromise

Unexpected client monitoring messages targeting internal queue names not used by legitimate clients
Anomalous activity from Velociraptor clients including unusual command execution or process spawning by the server process
Unexplained modifications to Velociraptor server configuration or artifact definitions
Connections to the Velociraptor server from clients with mismatched or unauthorized identities

Detection Strategies

Audit Velociraptor server logs for monitoring messages referencing non-standard or internal queue names
Monitor authentication events and client enrollment activity for unauthorized clients
Track child processes spawned by the Velociraptor server process for unexpected binaries or shell invocations
Compare client message volumes and queue routing patterns against historical baselines

Monitoring Recommendations

Enable verbose audit logging on the Velociraptor server and forward logs to a centralized SIEM for correlation
Alert on Velociraptor server process executing shell interpreters or network utilities outside normal operation
Continuously verify the integrity of client certificates and the enrolled client inventory

How to Mitigate CVE-2026-5329

Immediate Actions Required

Upgrade Velociraptor server to version 0.76.2 or later as soon as possible
Inventory all self-hosted Velociraptor server deployments, particularly on Linux
Review the list of enrolled clients and revoke any that are unrecognized or unauthorized
Restrict network access to the Velociraptor frontend to known client subnets where feasible

Patch Information

Rapid7 has released Velociraptor 0.76.2 to address CVE-2026-5329. The fix enforces validation of queue names in client monitoring messages, rejecting messages that target internal or privileged queues. Consult the Velociraptor Security Advisory CVE-2026-5329 for full upgrade guidance. Rapid7 Hosted Velociraptor instances have already been remediated and require no customer action.

Workarounds

No vendor-supplied workaround exists; upgrading to 0.76.2 is the only complete remediation
Limit Velociraptor client enrollment to trusted, attested endpoints and rotate client certificates
Place the Velociraptor server behind network segmentation that restricts which hosts can establish client connections

bash

# Verify the installed Velociraptor server version
velociraptor version

# Upgrade requires downloading the patched binary from Rapid7 and restarting the service
systemctl stop velociraptor_server
# Replace binary with 0.76.2 release, then:
systemctl start velociraptor_server