CVE-2026-78411— Velociraptor Server Metadata update with Insufficient Permission Check
Quick assessment
Affected
Rapid7 Velociraptor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Velociraptor 中的 函数使用了错误的权限检查机制，未能正确阻止非授权用户设置元数据。该漏洞使得拥有 权限的用户也能够更新服务器元数据。 服务器元数据通常用于存储仅应由服务器管理员进行更新的全站配置信息。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78411
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Velociraptor Server Metadata update with Insufficient Permission Check
Source: CVE Program / CVE List V5
Vulnerability Description
Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata.
Server metadata is often used to store site wide configuration data that should only be updated by the server admin.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Rapid7 | Velociraptor | 0 ~ 0.77.3 | - |
|
II. Public POCs for CVE-2026-78411
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78411
请登录查看更多情报信息。
Other References for CVE-2026-78411 (1)
Same Patch Batch · Rapid7 · 2026-10-05 · 3 CVEs total
| CVE-2026-78413 | 5.5 MEDIUM | Velociraptor privilege escalation via SysmonLogForward client monitoring artifact |
| CVE-2026-78412 | 4.9 MEDIUM | WatchEvent API streams another organization's live events |
IV. Related Vulnerabilities
Same product: Velociraptor
-
CVE-2026-78413
Velociraptor privilege escalation via SysmonLogForward clien -
CVE-2026-78412
WatchEvent API streams another organization's live events -
CVE-2026-77798
Velociraptor Authenticated Denial of Service -
CVE-2026-77797
Velociraptor Prefetch parser out of bounds -
CVE-2026-19072
Velociraptor Investigator reaches SuperUser via hunt Effecti
Same vendor: Rapid7
-
CVE-2026-78413
Velociraptor privilege escalation via SysmonLogForward clien -
CVE-2026-78412
WatchEvent API streams another organization's live events -
CVE-2026-97228
Rapid7 Bulk Export MCP — GraphQL Query Injection in Export S -
CVE-2026-89325
Rapid7 Insight Agent: Uncontrolled search path element in In -
CVE-2026-77798
Velociraptor Authenticated Denial of Service
Same weakness: CWE-863
-
CVE-2026-104978
Plane: Invitation Hijack in Project Join Flow via Missing Au -
CVE-2026-104961
Plane: WorkspaceOwnerPermission missing is_active check allo -
CVE-2026-105206
ZITADEL before 4.17.3 Cross-Organization Authentication Meth -
CVE-2026-105131
mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalati -
CVE-2026-105129
LaraDashboard before 1.4.8 Incorrect Authorization Exposes S
V. Comments for CVE-2026-78411
No comments yet