CVE-2026-19584
Received Received - Intake

Velociraptor Notebook Backup Privilege Escalation via VQL Injection

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: Rapid7, Inc.

Description
Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query which will be evaluated at elevated permissions if the notebook's backup is subsequently restored.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-19584
EUVD
EUVD-2026-75234

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
velociraptor velociraptor to 0.77.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1336 The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19584 is a high-severity vulnerability in Velociraptor, a digital forensics tool. It allows users with NOTEBOOK_EDITOR permission to embed malicious VQL queries in notebook cells. When a backup containing these queries is restored, the queries execute with elevated permissions due to missing access control checks. This can lead to unauthorized code execution and compromise system integrity.

Detection Guidance

Check Velociraptor logs for suspicious notebook backup restorations or VQL query executions. Inspect backup files for embedded VQL queries before restoration. Review user permissions for NOTEBOOK_EDITOR role to identify unauthorized access.

Impact Analysis

An attacker with NOTEBOOK_EDITOR permission could execute arbitrary code with elevated privileges during backup restoration. This may result in unauthorized access to sensitive data, system compromise, or further lateral movement within the network. The impact depends on the permissions of the restored notebook.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using vulnerable Velociraptor versions may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Upgrade Velociraptor to version 0.77.2 or later. Disable automatic restoration of notebook backups from untrusted sources. Implement strict access controls for NOTEBOOK_EDITOR permissions. Regularly audit backup files for malicious VQL queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19584. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart