CVE-2026-78411: Velociraptor Privilege Escalation Vulnerability

CVE-2026-78411 Overview

Velociraptor contains an authorization flaw in its SetClientMetadata function that uses the wrong permission check when writing server-level metadata. A user holding only the LABEL_CLIENTS permission can modify server metadata, which is typically reserved for administrators. Server metadata frequently stores site-wide configuration data that influences how the Velociraptor deployment behaves, so unauthorized writes can affect every endpoint managed by the server. The flaw is classified as an incorrect authorization weakness [CWE-863].

Critical Impact
A low-privileged authenticated user can tamper with server-wide configuration metadata, undermining the integrity of a Velociraptor deployment used for digital forensics and incident response.

Affected Products

Velociraptor digital forensics and incident response (DFIR) platform
Velociraptor server deployments exposing the SetClientMetadata API
Multi-tenant Velociraptor environments where non-admin users hold LABEL_CLIENTS

Discovery Timeline

2026-10-05 - CVE-2026-78411 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-78411

Vulnerability Analysis

Velociraptor exposes a SetClientMetadata API used to attach key/value metadata to clients. The same API path handles writes to server-level metadata when invoked without a specific client identifier. The server implementation checks the caller's permission against LABEL_CLIENTS rather than the administrative permission required for server configuration writes. Any authenticated user permitted to label clients can therefore write server metadata.

The practical impact depends on how an operator uses server metadata. Many Velociraptor deployments store site-wide configuration values, feature toggles, and operator-defined parameters there. Modifying those values can alter artifact behavior, hunt scoping, or integration settings across the entire server. The confidentiality of data is not directly affected, but integrity of configuration is.

Root Cause

The root cause is an incorrect authorization check [CWE-863]. The handler conflates two distinct operations: setting client-scoped metadata and setting server-scoped metadata. Both branches gate on LABEL_CLIENTS instead of distinguishing the required permission level per target. Server metadata writes should require a server administration permission.

Attack Vector

Exploitation requires an authenticated session with the LABEL_CLIENTS permission and network access to the Velociraptor GUI or API. The attacker invokes SetClientMetadata targeting the server metadata scope and supplies arbitrary key/value content. No user interaction is required. Full technical details are available in the Velociraptor Advisory CVE-2026-78411.

Detection Methods for CVE-2026-78411

Indicators of Compromise

Unexpected modifications to server metadata keys recorded in Velociraptor audit logs.
SetClientMetadata API calls originating from accounts that are not server administrators.
Changes to site-wide configuration values that do not correlate with planned administrative activity.

Detection Strategies

Review Velociraptor audit logs for SetClientMetadata invocations and correlate the calling user's role with the target scope.
Alert when accounts holding LABEL_CLIENTS but lacking server administration rights issue metadata write operations.
Baseline server metadata values and detect drift between known-good snapshots and the current state.

Monitoring Recommendations

Forward Velociraptor API and audit logs to a centralized SIEM for long-term retention and correlation.
Track role assignments granting LABEL_CLIENTS across the Velociraptor user base.
Monitor configuration-change events alongside authentication logs to attribute modifications to specific sessions.

How to Mitigate CVE-2026-78411

Immediate Actions Required

Upgrade Velociraptor to the fixed release referenced in the Velociraptor Advisory CVE-2026-78411.
Audit which accounts currently hold the LABEL_CLIENTS permission and revoke it from users who do not require it.
Snapshot current server metadata and compare against expected values to identify unauthorized changes.

Patch Information

Refer to the vendor advisory for the fixed version and upgrade instructions: Velociraptor Advisory CVE-2026-78411. The fix enforces the correct permission check when writing server-scoped metadata.

Workarounds

Restrict the LABEL_CLIENTS permission to trusted operators until the patched version is deployed.
Limit network exposure of the Velociraptor GUI and API to administrative networks.
Increase audit log review frequency for metadata-related API calls during the remediation window.

bash

# Configuration example
# Review user roles and permissions in the Velociraptor server configuration
velociraptor --config server.config.yaml user show <username>

# Remove the LABEL_CLIENTS permission from a non-admin role as a temporary mitigation
velociraptor --config server.config.yaml acl grant <username> '{"label_clients": false}'