CVE-2026-19200: NOTEBOOK_EDIT users can overwrite

CISO Take

Velociraptor's verify() VQL function was meant to lint an artifact for syntax errors, but an implementation flaw makes it operate against the live global artifact repository instead of a sandboxed copy, so any user holding only the NOTEBOOK_EDIT permission — a standard analyst-tier role — can silently overwrite artifacts they have no business modifying. Velociraptor is a DFIR/endpoint-hunting platform run with elevated trust across an entire fleet, so a tampered artifact becomes attacker-controlled VQL that executes wherever that artifact is later invoked by an admin, scheduled hunt, or another analyst — a clean path from low-privilege analyst access to fleet-wide code execution and evidence tampering. There's no public exploit, no Nuclei template, and it isn't in CISA KEV, but the CVSS 8.9 (network, low complexity, only low privileges required) reflects how little an insider or compromised analyst account needs to pull this off. Because Velociraptor is frequently the tool of record for incident investigations, a corrupted artifact also undermines the integrity of any forensic evidence or compliance evidence pack produced downstream. Patch to the fixed release referenced in the vendor advisory (docs.velociraptor.app/announcements/advisories/cve-2026-19200) and GitHub PR #4962, and until then audit artifact modification history and tighten who is granted NOTEBOOK_EDIT.

Sources:NVDvelociraptor.app

What is the risk?

High risk despite requiring authentication and user interaction: CVSS 8.9 with a changed scope (S:C) means an attacker confined to the notebook/analyst role can affect resources outside that role's intended boundary. Confidentiality and integrity impacts are both High because a malicious artifact overwrite can be leveraged into arbitrary VQL execution across every endpoint the platform manages; availability impact is only Low since the primary effect is unauthorized modification, not service disruption. Likelihood of exploitation is currently unclear — no EPSS score, no public PoC, no KEV listing, no scanner coverage — so this looks like a disclosed-and-patched issue rather than one under active exploitation, but the low bar (any analyst-level account) and broad blast radius (fleet-wide command execution) argue for prompt patching rather than waiting for exploitation signals.

How does the attack unfold?

Low-privilege access

Attacker holds or compromises a Velociraptor account with only the NOTEBOOK_EDIT permission, typical of an analyst role.

AML.T0012

Exploit verify() authorization flaw

Attacker calls the verify() VQL function, which operates against the global artifact repository instead of enforcing per-user edit permissions, allowing an unauthorized overwrite.

Malicious artifact planted

A trusted artifact is silently replaced with attacker-controlled VQL disguised as a legitimate update.

Fleet-wide execution and impact

When an administrator or scheduled hunt later invokes the tampered artifact, the attacker's VQL executes across managed endpoints with elevated privilege, achieving code execution and integrity compromise.

AML.T0050

Low-privilege access

Attacker holds or compromises a Velociraptor account with only the NOTEBOOK_EDIT permission, typical of an analyst role.

AML.T0012

Exploit verify() authorization flaw

Attacker calls the verify() VQL function, which operates against the global artifact repository instead of enforcing per-user edit permissions, allowing an unauthorized overwrite.

Malicious artifact planted

A trusted artifact is silently replaced with attacker-controlled VQL disguised as a legitimate update.

Fleet-wide execution and impact

When an administrator or scheduled hunt later invokes the tampered artifact, the attacker's VQL executes across managed endpoints with elevated privilege, achieving code execution and integrity compromise.

AML.T0050

How severe is it?

CVSS 3.1

8.9 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SChanged

CHigh

IHigh

ALow

What should I do?

1 step

1) Patch to the fixed Velociraptor release referenced in the vendor advisory (docs.velociraptor.app/announcements/advisories/cve-2026-19200) and corresponding fix in GitHub PR Velocidex/velociraptor#4962. 2) Until patched, restrict NOTEBOOK_EDIT to the minimum set of trusted analysts and avoid granting it broadly to junior/rotating staff. 3) Audit artifact version history / GitOps-tracked artifact definitions for unexpected changes, especially to artifacts used in automated hunts or response actions. 4) Alert on artifact modification events in Velociraptor's own audit log and correlate against expected change-management activity. 5) Where possible, run artifacts from a version-controlled, code-reviewed source of truth rather than trusting in-server edits.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassCode ExecutionFrameworkPluginAML.T0012- Valid Accounts AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

GOVERN 6.1-Third-party and vendor tooling risk management

Frequently Asked Questions

What is CVE-2026-19200?

Velociraptor's verify() VQL function was meant to lint an artifact for syntax errors, but an implementation flaw makes it operate against the live global artifact repository instead of a sandboxed copy, so any user holding only the NOTEBOOK_EDIT permission — a standard analyst-tier role — can silently overwrite artifacts they have no business modifying. Velociraptor is a DFIR/endpoint-hunting platform run with elevated trust across an entire fleet, so a tampered artifact becomes attacker-controlled VQL that executes wherever that artifact is later invoked by an admin, scheduled hunt, or another analyst — a clean path from low-privilege analyst access to fleet-wide code execution and evidence tampering. There's no public exploit, no Nuclei template, and it isn't in CISA KEV, but the CVSS 8.9 (network, low complexity, only low privileges required) reflects how little an insider or compromised analyst account needs to pull this off. Because Velociraptor is frequently the tool of record for incident investigations, a corrupted artifact also undermines the integrity of any forensic evidence or compliance evidence pack produced downstream. Patch to the fixed release referenced in the vendor advisory (docs.velociraptor.app/announcements/advisories/cve-2026-19200) and GitHub PR #4962, and until then audit artifact modification history and tighten who is granted NOTEBOOK_EDIT.

Is CVE-2026-19200 actively exploited?

No confirmed active exploitation of CVE-2026-19200 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-19200?

1) Patch to the fixed Velociraptor release referenced in the vendor advisory (docs.velociraptor.app/announcements/advisories/cve-2026-19200) and corresponding fix in GitHub PR Velocidex/velociraptor#4962. 2) Until patched, restrict NOTEBOOK_EDIT to the minimum set of trusted analysts and avoid granting it broadly to junior/rotating staff. 3) Audit artifact version history / GitOps-tracked artifact definitions for unexpected changes, especially to artifacts used in automated hunts or response actions. 4) Alert on artifact modification events in Velociraptor's own audit log and correlate against expected change-management activity. 5) Where possible, run artifacts from a version-controlled, code-reviewed source of truth rather than trusting in-server edits.

What systems are affected by CVE-2026-19200?

This vulnerability affects the following AI/ML architecture patterns: Security orchestration / DFIR artifact repositories, Endpoint detection and response (EDR) fleet management, SOC automation and scheduled-hunt pipelines, Compliance evidence collection workflows.

What is the CVSS score for CVE-2026-19200?

CVE-2026-19200 has a CVSS v3.1 base score of 8.9 (HIGH). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

Security orchestration / DFIR artifact repositoriesEndpoint detection and response (EDR) fleet managementSOC automation and scheduled-hunt pipelinesCompliance evidence collection workflows

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

NIST AI RMF: GOVERN 6.1

What are the technical details?

Original Advisory

The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker need only have the NOTEBOOK_EDIT permission (e.g. an analyst role) to be able to call this function.

Exploitation Scenario

An organization onboards a contractor or junior SOC analyst with the standard 'analyst' role, which includes NOTEBOOK_EDIT. The analyst (or an attacker who has phished/compromised that analyst's session) calls the verify() VQL function against a high-trust artifact used by senior responders — for example, a remediation artifact that quarantines hosts or collects sensitive data. Because verify() operates on the global repository without checking artifact-edit permissions, the call silently overwrites the artifact with attacker-supplied VQL disguised as a syntax fix. Days later, an administrator or scheduled hunt invokes that artifact across the endpoint fleet, unknowingly executing the attacker's VQL with the elevated privileges of whoever/whatever triggered it — achieving lateral code execution and potentially exfiltrating data or planting persistence across every managed endpoint, all traceable back to a user who should only have had notebook-level access.

Weaknesses (CWE)

CWE-862Missing Authorization CWE-862Missing Authorization CWE-94Improper Control of Generation of Code CWE-94Improper Control of Generation of Code

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.