Description

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-12T05:19:17.893Z",
  "pubdate": "2026-08-12T05:19:17.893Z",
  "executiveSummary": "A privilege escalation vulnerability exists in Velociraptor that allows an authenticated user with the analyst role to perform actions restricted to the investigator role.\nThe vulnerability is characterized by a missing authorization enforcement mechanism when executing specific VQL queries.\nSpecifically, Velociraptor permits scheduling new collections via VQL queries in notebooks.\nWhile this action normally requires the COLLECT_CLIENT permission, this requirement is not enforced if a user executes a VQL query capable of resetting the authorization provider.\nThe affected product is Velociraptor.\nThe risk implications involve horizontal and vertical privilege escalation, enabling lower-privileged analysts to launch unauthorized client collections typically reserved for investigators.\nAttackers require the capability to execute arbitrary VQL queries, usually granted under the analyst role, to successfully exploit the flaw.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient access control enforcement within the VQL execution engine and authorization provider logic in Velociraptor.\nVelociraptor supports scheduling new data collections through VQL queries embedded within notebooks.\nUnder normal operational parameters, execution of collection scheduling requires the explicit COLLECT_CLIENT permission, which is mapped to higher privilege levels such as the investigator role.\nHowever, the validation check enforcing the COLLECT_CLIENT permission can be bypassed if the execution context processes a VQL query designed to reset the internal authorization provider.\nThe vulnerable component involves the authorization validation routines tied to notebook VQL execution and authorization state management.\nAn attacker possessing standard analyst-level privileges, who is normally restricted to running arbitrary VQL queries without full collection capabilities, can craft and execute a specific VQL payload.\nThe attack flow proceeds as follows: First, the low-privileged analyst authenticates to the Velociraptor interface with standard analyst credentials. Second, the user accesses or creates a notebook and inputs a malicious or specially crafted VQL query designed to manipulate or reset the authorization provider state. Third, upon execution of this query, the authorization context is improperly modified or cleared, causing the system to fail enforcement of the COLLECT_CLIENT permission check. Finally, the user successfully schedules and launches new client collections, thereby escalating their functional privileges from an analyst to an investigator role.\nPost-exploitation impact includes unauthorized data collection from endpoints across the environment, potentially exposing sensitive forensic artifacts and compromising the integrity of access controls within the Velociraptor deployment."
}