CVE-2026-64954: VQL auth-reset lets analyst gain

CISO Take

Velociraptor, the open-source DFIR/endpoint-forensics platform, lets any authenticated user with only the low-privilege "analyst" role escalate to "investigator" by crafting a VQL query in a notebook that resets the internal authorization provider, silently bypassing the COLLECT_CLIENT permission check needed to schedule new evidence collections. The attack requires no user interaction and only low privileges (PR:L), but high attack complexity (AC:H) since the attacker must understand VQL internals and the specific authorization-reset behavior, which is reflected in the modest 0.23% EPSS score even though it sits in the top 86th percentile for exploitation likelihood among scored CVEs. There is no evidence of active exploitation, it is not in CISA KEV, no public exploit or Nuclei template exists, and CISA's own SSVC decision is TRACK (routine patching, no urgency escalation). For CISOs, the real risk is scope creep inside incident-response tooling itself: an analyst-tier user (often a junior SOC member or outsourced contractor) could pull forensic collections they were never authorized to see, undermining least-privilege guarantees during live investigations. Patch to the fixed Velociraptor release referenced in the vendor advisory and commit d7de958, and in the interim audit notebook/VQL execution logs for analyst-role users invoking collection-scheduling queries outside their normal workflow.

Sources:NVDCISA KEVEPSSGitHub Advisorydocs.velociraptor.app

What is the risk?

Moderate-high severity (CVSS 8.2) driven by a confidentiality+integrity impact with scope change (S:C) — a low-privilege authenticated analyst can obtain investigator-level data-collection capability. Exploitability is constrained by high attack complexity (AC:H): the attacker needs specific knowledge of how VQL queries interact with the authorization provider, which is not common knowledge and has no public PoC or scanner coverage. No CISA KEV listing, no exploit-in-the-wild evidence, and an SSVC "TRACK" decision all indicate this is not an emergency-patch scenario, but the low EPSS score should not be read as "safe to ignore" — Velociraptor is deployed precisely in environments (SOC/IR teams) where privilege boundaries between analyst and investigator roles are a deliberate, security-critical control, so even a complex-to-exploit bypass has outsized trust impact if triggered.

How does the attack unfold?

Authenticated Low-Privilege Access

Attacker holds a legitimate but restricted "analyst" role account with VQL notebook access, satisfying the low-privilege precondition (PR:L, UI:N).

Authorization Provider Reset

Attacker crafts a VQL query in a notebook that resets the internal authorization provider, causing the COLLECT_CLIENT permission check to be skipped.

Privilege Escalation

With the permission check bypassed, the analyst schedules a new endpoint collection normally requiring the "investigator" role.

Unauthorized Data Access

Attacker obtains forensic artifacts from client endpoints outside their authorized case scope, breaching confidentiality and integrity of the investigation's evidence chain.

Authenticated Low-Privilege Access

Attacker holds a legitimate but restricted "analyst" role account with VQL notebook access, satisfying the low-privilege precondition (PR:L, UI:N).

Authorization Provider Reset

Attacker crafts a VQL query in a notebook that resets the internal authorization provider, causing the COLLECT_CLIENT permission check to be skipped.

Privilege Escalation

With the permission check bypassed, the analyst schedules a new endpoint collection normally requiring the "investigator" role.

Unauthorized Data Access

Attacker obtains forensic artifacts from client endpoints outside their authorized case scope, breaching confidentiality and integrity of the investigation's evidence chain.

How severe is it?

CVSS 3.1

8.2 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SChanged

CHigh

IHigh

ANone

What should I do?

1 step

Upgrade to the patched Velociraptor version referenced in the vendor advisory (docs.velociraptor.app/announcements/advisories/cve-2026-64954) and commit d7de958e846d3742a7a3a8538fd463e4f12fc528. Until patched, review which users hold the "analyst" role and whether they have unsupervised VQL notebook access — consider temporarily restricting notebook VQL execution to trusted investigator-tier users. Enable and review Velociraptor audit logs for collection-scheduling events triggered by analyst-role accounts, especially any preceded by queries that manipulate authorization/session state. After patching, re-verify that COLLECT_CLIENT permission enforcement holds even when VQL queries attempt to reset the authorization provider.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassAgent

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-64954?

Velociraptor, the open-source DFIR/endpoint-forensics platform, lets any authenticated user with only the low-privilege "analyst" role escalate to "investigator" by crafting a VQL query in a notebook that resets the internal authorization provider, silently bypassing the COLLECT_CLIENT permission check needed to schedule new evidence collections. The attack requires no user interaction and only low privileges (PR:L), but high attack complexity (AC:H) since the attacker must understand VQL internals and the specific authorization-reset behavior, which is reflected in the modest 0.23% EPSS score even though it sits in the top 86th percentile for exploitation likelihood among scored CVEs. There is no evidence of active exploitation, it is not in CISA KEV, no public exploit or Nuclei template exists, and CISA's own SSVC decision is TRACK (routine patching, no urgency escalation). For CISOs, the real risk is scope creep inside incident-response tooling itself: an analyst-tier user (often a junior SOC member or outsourced contractor) could pull forensic collections they were never authorized to see, undermining least-privilege guarantees during live investigations. Patch to the fixed Velociraptor release referenced in the vendor advisory and commit d7de958, and in the interim audit notebook/VQL execution logs for analyst-role users invoking collection-scheduling queries outside their normal workflow.

Is CVE-2026-64954 actively exploited?

No confirmed active exploitation of CVE-2026-64954 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-64954?

Upgrade to the patched Velociraptor version referenced in the vendor advisory (docs.velociraptor.app/announcements/advisories/cve-2026-64954) and commit d7de958e846d3742a7a3a8538fd463e4f12fc528. Until patched, review which users hold the "analyst" role and whether they have unsupervised VQL notebook access — consider temporarily restricting notebook VQL execution to trusted investigator-tier users. Enable and review Velociraptor audit logs for collection-scheduling events triggered by analyst-role accounts, especially any preceded by queries that manipulate authorization/session state. After patching, re-verify that COLLECT_CLIENT permission enforcement holds even when VQL queries attempt to reset the authorization provider.

What is the CVSS score for CVE-2026-64954?

CVE-2026-64954 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.31%.

What are the technical details?

Original Advisory

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role.

Exploitation Scenario

An outsourced or junior SOC analyst with legitimate but restricted "analyst" access to the organization's Velociraptor deployment opens a notebook and writes a VQL query designed to reset the session's authorization provider mid-execution. This causes Velociraptor to lose track of the fact that the COLLECT_CLIENT permission check should apply, and the analyst's subsequent VQL call schedules a brand-new endpoint collection against a client — a capability normally reserved for the "investigator" role. The analyst now pulls forensic artifacts (files, memory, registry data) from an endpoint outside their authorized case scope, potentially exposing sensitive data from an unrelated investigation or exfiltrating evidence before proper chain-of-custody review.

Weaknesses (CWE)

CWE-862Missing Authorization CWE-862Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.