Description

The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions.  The attacker need only have the NOTEBOOK_EDIT permission (e.g. an analyst role) to be able to call this function.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.9",
  "pubDate": "2026-08-24T04:16:46.557Z",
  "pubdate": "2026-08-24T04:16:46.557Z",
  "executiveSummary": "An improper authorization and access control vulnerability exists within the Velociraptor verify() VQL function. This flaw stems from an implementation fault that incorrectly interacts with the global artifact repository during the artifact verification process.\nThe vulnerability allows an authenticated user with limited privileges, specifically the NOTEBOOK_EDIT permission associated with an analyst role, to bypass standard permission checks and overwrite existing artifacts within the system.\nThe impact of successful exploitation includes unauthorized modification and integrity compromise of critical system artifacts, potentially allowing malicious actors to alter forensic data collection routines, manipulate query execution flows, or poison shared operational resources.\nRisk implications are significant for multi-tenant or multi-user deployments where role-based access control is relied upon to segregate duties between standard analysts and administrative users.\nExploitation requirements are limited to possessing the NOTE_BOOK_EDIT permission and the ability to invoke the vulnerable verify() VQL function.\nMitigation requires applying official patches or updates from the vendor once available, restricting user roles, and monitoring VQL query execution for unauthorized artifact modification attempts.",
  "technicalDetails": "The vulnerability resides in the verify() VQL function within Velociraptor, which is designed to allow users to inspect and validate artifacts for syntactic and structural correctness.\nThe root cause of the vulnerability is an implementation fault in the scope and context handling of the verify() function. Instead of operating within an isolated context or enforcing strict permission boundaries aligned with the caller's authorization level, the function improperly interacts with the global artifact repository.\nAuthentication and privilege requirements are relatively low; an attacker requires only the NOTEBOOK_EDIT permission, typically assigned to the analyst role, to successfully execute the vulnerable VQL function.\nThe step-by-step attack flow proceeds as follows: First, an attacker authenticates to the Velociraptor platform with a low-privileged role possessing NOTEBOOK_EDIT capabilities. Second, the attacker formulates a malicious VQL query invoking the verify() function. Third, by leveraging the implementation flaw, the function processes the request using the global artifact repository context rather than a restricted user-scoped context. Fourth, the attacker supplies a crafted artifact payload designed to target an existing artifact name within the repository. Finally, the function overwrites the target artifact with the attacker-controlled definition without validating whether the caller possesses administrative privileges or the specific authorization required to modify global artifacts.\nThe vulnerable component is the VQL engine, specifically the handling of artifact verification logic within the verify() function.\nPost-exploitation impact includes the degradation of platform integrity, unauthorized persistence through modified collection logic, and the potential execution of malicious VQL queries disguised as standard operational artifacts during future forensic investigations."
}