CVE-2026-19584: VQL injection — HIGH

CISO Take

Velociraptor, the open-source DFIR/endpoint-hunting platform, has a stored privilege-escalation flaw in its default-enabled daily notebook backup feature: notebook cell content is interpolated into a restore template with no ACL checks, so a user holding only the low-privilege NOTEBOOK_EDITOR role can plant a malicious VQL query that executes at whatever elevated permission level performs the restore. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template for this CVE yet, and exploitation requires attack complexity 'high' plus user interaction (someone must trigger the backup restore) — so this is not a mass-exploitable, internet-facing issue. The real exposure is insider-threat and compromised-low-privilege-account scenarios inside incident-response teams, where Velociraptor itself often runs with fleet-wide, highly privileged access to endpoints. Patch to the fixed release referenced in the vendor advisory (docs.velociraptor.app/announcements/advisories/cve-2026-19584) and GitHub PR #4967, and in the meantime restrict who holds NOTEBOOK_EDITOR and who is permitted to perform notebook backup restores. Audit notebook content before any restore operation and review Velociraptor audit logs for VQL execution immediately following a restore event as a detection signal.

Sources: NVD CISA KEV GitHub Advisory velociraptor.app

What is the risk?

CVSS 7.7 (High) with a Scope-Changed vector reflects a serious but constrained privilege-escalation path: Attack Complexity is High and User Interaction is Required, meaning an attacker cannot trigger this unilaterally — they must first hold (or compromise) an account with NOTEBOOK_EDITOR permission, then wait for or induce a privileged operator to restore that notebook's backup. There is no evidence of active exploitation (not in CISA KEV), no published PoC, and no EPSS data, which together suggest low near-term mass-exploitation likelihood. However, because Velociraptor deployments typically carry elevated, fleet-wide access to endpoints for DFIR purposes, a successful exploit chain converts a low-privilege notebook user into a high-privilege operator (C:H/I:H), representing a meaningful lateral/vertical escalation risk inside SOC/IR environments, particularly where NOTEBOOK_EDITOR is broadly granted to junior analysts or automation accounts.

How does the attack unfold?

Precondition: low-privilege access

Attacker holds or compromises an account with NOTEBOOK_EDITOR permission, the minimum access needed to edit notebook cell content.

Malicious VQL planting

Attacker embeds a malicious VQL query in a notebook cell; the default-enabled daily backup captures this content automatically with no ACL re-validation planned for restore time.

Dormant persistence via backup

The poisoned notebook content sits latent inside the daily backup archive until a restore operation is performed, requiring no further attacker action.

Privilege escalation on restore

A higher-privileged operator restores the backup; the interpolated VQL executes at that elevated permission level, giving the attacker scope-changed confidentiality and integrity impact across the platform.

Precondition: low-privilege access

Attacker holds or compromises an account with NOTEBOOK_EDITOR permission, the minimum access needed to edit notebook cell content.

Malicious VQL planting

Attacker embeds a malicious VQL query in a notebook cell; the default-enabled daily backup captures this content automatically with no ACL re-validation planned for restore time.

Dormant persistence via backup

The poisoned notebook content sits latent inside the daily backup archive until a restore operation is performed, requiring no further attacker action.

Privilege escalation on restore

A higher-privileged operator restores the backup; the interpolated VQL executes at that elevated permission level, giving the attacker scope-changed confidentiality and integrity impact across the platform.

How severe is it?

CVSS 3.1

7.7 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI Required

S Changed

C High

I High

A None

What should I do?

1 step

1) Apply the vendor patch referenced in the advisory (docs.velociraptor.app/announcements/advisories/cve-2026-19584) and tracked in GitHub PR #4967 as soon as it is available for your deployed version. 2) Until patched, minimize the population holding NOTEBOOK_EDITOR permission and treat it as equivalent to a code-execution-capable role, not a read/write content role. 3) Restrict who can trigger notebook backup restores to trusted admins, and avoid automating restores without a manual content review step. 4) Before restoring any notebook backup, inspect cell content for anomalous or obfuscated VQL. 5) Monitor Velociraptor server logs for VQL execution events immediately following a restore operation, and alert on VQL that performs privileged actions (client tasking, credential access, file system writes) shortly after a restore. 6) Apply least-privilege review to all notebook-related roles as part of routine Velociraptor access audits.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Framework

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-19584?

Velociraptor, the open-source DFIR/endpoint-hunting platform, has a stored privilege-escalation flaw in its default-enabled daily notebook backup feature: notebook cell content is interpolated into a restore template with no ACL checks, so a user holding only the low-privilege NOTEBOOK_EDITOR role can plant a malicious VQL query that executes at whatever elevated permission level performs the restore. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template for this CVE yet, and exploitation requires attack complexity 'high' plus user interaction (someone must trigger the backup restore) — so this is not a mass-exploitable, internet-facing issue. The real exposure is insider-threat and compromised-low-privilege-account scenarios inside incident-response teams, where Velociraptor itself often runs with fleet-wide, highly privileged access to endpoints. Patch to the fixed release referenced in the vendor advisory (docs.velociraptor.app/announcements/advisories/cve-2026-19584) and GitHub PR #4967, and in the meantime restrict who holds NOTEBOOK_EDITOR and who is permitted to perform notebook backup restores. Audit notebook content before any restore operation and review Velociraptor audit logs for VQL execution immediately following a restore event as a detection signal.

Is CVE-2026-19584 actively exploited?

No confirmed active exploitation of CVE-2026-19584 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-19584?

1) Apply the vendor patch referenced in the advisory (docs.velociraptor.app/announcements/advisories/cve-2026-19584) and tracked in GitHub PR #4967 as soon as it is available for your deployed version. 2) Until patched, minimize the population holding NOTEBOOK_EDITOR permission and treat it as equivalent to a code-execution-capable role, not a read/write content role. 3) Restrict who can trigger notebook backup restores to trusted admins, and avoid automating restores without a manual content review step. 4) Before restoring any notebook backup, inspect cell content for anomalous or obfuscated VQL. 5) Monitor Velociraptor server logs for VQL execution events immediately following a restore operation, and alert on VQL that performs privileged actions (client tasking, credential access, file system writes) shortly after a restore. 6) Apply least-privilege review to all notebook-related roles as part of routine Velociraptor access audits.

What systems are affected by CVE-2026-19584?

This vulnerability affects the following AI/ML architecture patterns: notebook environments.

What is the CVSS score for CVE-2026-19584?

CVE-2026-19584 has a CVSS v3.1 base score of 7.7 (HIGH). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

notebook environments

What are the technical details?

Original Advisory

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query which will be evaluated at elevated permissions if the notebook's backup is subsequently restored.

Exploitation Scenario

A junior SOC analyst or an attacker who has compromised a low-privileged Velociraptor account with NOTEBOOK_EDITOR permission crafts a VQL query designed to execute privileged actions (e.g., tasking arbitrary commands to managed endpoints or reading sensitive server-side data) and embeds it in a notebook cell disguised as a legitimate investigation query. Velociraptor's default daily backup job captures this notebook state automatically, requiring no further action from the attacker. Later, a higher-privileged administrator restores that notebook's backup — for example during a server migration, disaster recovery, or to recover a notebook after accidental deletion. Because the restore process interpolates the stored cell content into a template without re-validating ACLs, the planted VQL executes with the restoring administrator's elevated permissions, giving the original low-privilege attacker effective admin-level code execution and data access across the Velociraptor deployment and the endpoint fleet it manages.

Weaknesses (CWE)

CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine CWE-94 Improper Control of Generation of Code ('Code Injection') CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-1336 — Improper Neutralization of Special Elements Used in a Template Engine: The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

[Architecture and Design] Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.
[Implementation] Use the template engine's sandbox or restricted mode, if available.

Source: MITRE CWE corpus.