CVE-2026-64952: Velociraptor Auth Bypass Vulnerability

CVE-2026-64952 Overview

CVE-2026-64952 is an authorization flaw in Velociraptor, an open-source endpoint monitoring and digital forensics platform. The hunt_delete() VQL (Velociraptor Query Language) function enforces the wrong permission check. It requires only COLLECT_CLIENT, which is typically granted to the investigator role, rather than the intended DELETE_RESULTS permission usually reserved for administrators. As a result, lower-privileged users can delete hunts they should not have authority to remove. The issue is classified as an incorrect authorization weakness [CWE-863] and affects the integrity of Velociraptor hunt data.

Critical Impact
Authenticated users with the investigator role can delete arbitrary hunts, destroying collection records and hindering ongoing investigations.

Affected Products

Velociraptor endpoint monitoring and digital forensics platform
Deployments exposing the hunt_delete() VQL function to non-administrative users
Multi-tenant Velociraptor environments where investigator roles are assigned broadly

Discovery Timeline

2026-08-12 - CVE-2026-64952 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-64952

Vulnerability Analysis

Velociraptor exposes administrative actions through VQL functions gated by permission checks. The hunt_delete() function permits removal of hunts, which are collection jobs distributed across endpoints. Deleting a hunt destroys its metadata and associated results, which can disrupt ongoing incident response work. The advisory states that the function checks for COLLECT_CLIENT instead of DELETE_RESULTS. Because COLLECT_CLIENT is a permission that operators routinely grant to the investigator role, any user in that role can invoke hunt_delete() successfully. The intended design reserves destructive operations for the administrator role via DELETE_RESULTS.

Root Cause

The root cause is a permission mapping error in the server-side authorization logic for the hunt_delete() VQL function. The function calls the permission enforcement path with the wrong constant, so the check succeeds for principals that should be denied. This is a classic incorrect authorization pattern [CWE-863], where the enforcement mechanism exists but validates the wrong capability.

Attack Vector

Exploitation requires an authenticated Velociraptor account with the COLLECT_CLIENT permission. The attacker submits a VQL query invoking hunt_delete() with a target hunt identifier. The server accepts the call and removes the hunt without administrator approval. No user interaction or additional privileges are required. See the Velociraptor Security Advisory CVE-2026-64952 for authoritative technical details.

Detection Methods for CVE-2026-64952

Indicators of Compromise

Audit log entries showing hunt_delete() VQL calls executed by users lacking the administrator role.
Unexpected disappearance of hunts from the Velociraptor GUI or API listings.
VQL query history from investigator accounts referencing hunt identifiers followed by deletion events.

Detection Strategies

Review Velociraptor server audit logs for invocations of hunt_delete() and correlate the caller identity against expected administrative accounts.
Baseline the frequency of hunt deletion operations and alert on deviations from that baseline.
Compare current hunt inventories against periodic backups to identify unauthorized removals.

Monitoring Recommendations

Forward Velociraptor audit logs to a centralized SIEM or data lake for retention and correlation.
Create alerts for any hunt_delete() call originating from a non-administrator principal.
Monitor role and permission assignments for expansion of COLLECT_CLIENT beyond trusted analysts.

How to Mitigate CVE-2026-64952

Immediate Actions Required

Upgrade Velociraptor to the fixed release identified in the vendor advisory as soon as it is available in your environment.
Audit accounts holding the investigator role and remove access from users who do not require it.
Back up hunt metadata and collection results so unauthorized deletions can be reconstructed.

Patch Information

Refer to the Velociraptor Security Advisory CVE-2026-64952 for the fixed version and upgrade guidance. The patch corrects the permission check inside hunt_delete() so the function enforces DELETE_RESULTS rather than COLLECT_CLIENT.

Workarounds

Restrict the investigator role assignment to a minimal set of trusted users until the patch is deployed.
Increase logging verbosity for VQL calls and review hunt_delete() activity daily.
Use organizational separation in multi-tenant deployments so investigators cannot enumerate hunts belonging to other teams.

bash

# Example: list users and roles to identify accounts that could invoke hunt_delete()
velociraptor --config server.config.yaml user show --all

# Remove the investigator role from an account that no longer requires it
velociraptor --config server.config.yaml acl grant <username> '{"roles":["reader"]}'