CVE-2026-64954: Velociraptor Privilege Escalation Flaw

CVE-2026-64954 Overview

CVE-2026-64954 is a privilege escalation vulnerability in Velociraptor, an open-source digital forensics and incident response platform. The flaw allows a user with the analyst role to schedule new client collections that normally require the investigator role and the COLLECT_CLIENT permission. Velociraptor permits scheduling collections through Velociraptor Query Language (VQL) queries executed in notebooks. The authorization check for COLLECT_CLIENT is not enforced when a user runs a VQL query that resets the authorization provider. This missing authorization issue is tracked as [CWE-862].

Critical Impact
A low-privileged analyst can escalate to investigator-level capability and launch arbitrary collections against endpoint clients, expanding the blast radius of a compromised analyst account.

Affected Products

Velociraptor (Velocidex) DFIR server
Deployments exposing notebook VQL execution to analyst-role users
Installations prior to the fix in commit d7de958

Discovery Timeline

2026-08-12 - CVE-2026-64954 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-64954

Vulnerability Analysis

Velociraptor enforces role-based access control through Access Control Lists (ACLs) checked against an authorization provider. The COLLECT_CLIENT permission gates the ability to schedule new client collections. Scheduling is exposed through the API and, indirectly, through VQL executed inside notebooks.

The vulnerability arises because certain VQL statements can reset the authorization provider inside the notebook execution context. Once the provider is reset, subsequent VQL calls that would ordinarily require COLLECT_CLIENT are executed without that check. An analyst user, whose intended role is limited to running queries and reviewing data, can therefore invoke collection-scheduling functions reserved for investigators.

The patched code in api/hunts.go reworks the permission dispatch so hunt state transitions map to explicit permissions rather than a single conditional branch, ensuring START_HUNT and DELETE_RESULTS are consistently required. A parallel change in api/authenticators/template.go replaces text/template with html/template to prevent template-based injection paths that could reach the same code path.

Root Cause

The root cause is missing authorization enforcement [CWE-862] on a code path reachable through VQL notebook execution. The authorization provider is trusted to remain constant throughout a query, but VQL can mutate it, bypassing the COLLECT_CLIENT check before scheduling a collection.

Attack Vector

An authenticated user with the analyst role and access to notebooks runs VQL that resets the authorization provider, then invokes a collection-scheduling function. The attack requires valid credentials and knowledge of the specific VQL constructs, which aligns with the high attack complexity rating. Successful exploitation grants investigator-level collection control over connected clients.

// Patched dispatch in api/hunts.go
principal := user_record.Name

permissions := acls.COLLECT_CLIENT
switch in.State {
case api_proto.Hunt_RUNNING:
    permissions = acls.START_HUNT

case api_proto.Hunt_DELETED:
    permissions = acls.DELETE_RESULTS
}

perm, err := services.CheckAccess(org_config_obj, principal, permissions)
// Source: https://github.com/Velocidex/velociraptor/commit/d7de958e846d3742a7a3a8538fd463e4f12fc528

// Patched import in api/authenticators/template.go
package authenticators

import (
    "html/template"
    "net/http"
    "strings"

    api_utils "www.velocidex.com/golang/velociraptor/api/utils"
    config_proto "www.velocidex.com/golang/velociraptor/config/proto"
)
// Source: https://github.com/Velocidex/velociraptor/commit/d7de958e846d3742a7a3a8538fd463e4f12fc528

Detection Methods for CVE-2026-64954

Indicators of Compromise

Notebook VQL cells authored by analyst-role users that reference authorization or ACL manipulation functions.
Audit log entries showing collections scheduled by principals lacking the COLLECT_CLIENT permission.
Unexpected new Flow or hunt objects tied to analyst accounts within a short window after notebook activity.
Divergence between the acting principal recorded on a collection and that principal's assigned role.

Detection Strategies

Review Velociraptor audit logs for CheckAccess denials followed by successful collection creation from the same session.
Correlate notebook execution events with subsequent Flow scheduling API calls per user.
Baseline collection-scheduling behavior per role and alert on analyst-role principals initiating collections.

Monitoring Recommendations

Ship Velociraptor server logs to a centralized SIEM or data lake and retain notebook VQL history.
Enable verbose ACL logging on the Velociraptor server to capture principal-permission decisions.
Alert on any change to user role assignments and on newly created notebooks by analyst-role accounts.

How to Mitigate CVE-2026-64954

Immediate Actions Required

Upgrade Velociraptor to a build that includes commit d7de958.
Audit all users assigned the analyst role and revoke notebook access where it is not required.
Review recent collections and hunts for scheduling actions performed by analyst-role principals.
Rotate credentials and API tokens for any analyst account suspected of exploitation.

Patch Information

The fix is delivered in Velociraptor commit d7de958e846d3742a7a3a8538fd463e4f12fc528, which enforces the correct permission based on hunt state and hardens template handling in api/authenticators/template.go. Refer to the Velociraptor Security Advisory CVE-2026-64954 for release-specific guidance.

Workarounds

Restrict notebook creation and VQL execution to trusted investigator and administrator roles until patched.
Disable or gate the notebook feature at the reverse-proxy layer for analyst-role users.
Enforce network segmentation so the Velociraptor GUI is reachable only from managed administrator workstations.

bash

# Verify installed Velociraptor version and upgrade
velociraptor version

# Pull the patched source and build
git clone https://github.com/Velocidex/velociraptor.git
cd velociraptor
git checkout d7de958e846d3742a7a3a8538fd463e4f12fc528
make linux

# Restart the server after replacing the binary
systemctl restart velociraptor_server