CVE-2026-6290— Velociraptor Query() Plugin Misapplies Permissions To Orgs
Quick assessment
Affected
Rapid7 Velociraptor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Velociraptor是Velocidex开源的一种使用 Velociraptor 查询语言（VQL）查询收集基于主机的状态信息的工具。 Velociraptor 0.76.3之前版本存在安全漏洞，该漏洞源于query插件允许使用当前ACL令牌访问所有组织，可能导致经过身份验证的用户跨组织执行未授权查询。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-6290
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Velociraptor Query() Plugin Misapplies Permissions To Orgs
Source: CVE Program / CVE List V5
Vulnerability Description
Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are
the same as the permissions they have in the org containing the notebook.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Velociraptor 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Velociraptor是Velocidex开源的一种使用 Velociraptor 查询语言（VQL）查询收集基于主机的状态信息的工具。 Velociraptor 0.76.3之前版本存在安全漏洞，该漏洞源于query插件允许使用当前ACL令牌访问所有组织，可能导致经过身份验证的用户跨组织执行未授权查询。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Rapid7 | Velociraptor | 0 ~ 0.76.3, 0.75.8 | - |
|
II. Public POCs for CVE-2026-6290
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-6290
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Velociraptor
-
CVE-2026-78413
Velociraptor privilege escalation via SysmonLogForward clien -
CVE-2026-78411
Velociraptor Server Metadata update with Insufficient Permis -
CVE-2026-78412
WatchEvent API streams another organization's live events -
CVE-2026-77798
Velociraptor Authenticated Denial of Service -
CVE-2026-77797
Velociraptor Prefetch parser out of bounds
Same vendor: Rapid7
-
CVE-2026-78413
Velociraptor privilege escalation via SysmonLogForward clien -
CVE-2026-78411
Velociraptor Server Metadata update with Insufficient Permis -
CVE-2026-78412
WatchEvent API streams another organization's live events -
CVE-2026-97228
Rapid7 Bulk Export MCP — GraphQL Query Injection in Export S -
CVE-2026-89325
Rapid7 Insight Agent: Uncontrolled search path element in In
Same weakness: CWE-863
-
CVE-2026-104978
Plane: Invitation Hijack in Project Join Flow via Missing Au -
CVE-2026-78411
Velociraptor Server Metadata update with Insufficient Permis -
CVE-2026-104961
Plane: WorkspaceOwnerPermission missing is_active check allo -
CVE-2026-105206
ZITADEL before 4.17.3 Cross-Organization Authentication Meth -
CVE-2026-105131
mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalati
V. Comments for CVE-2026-6290
No comments yet