CVE-2026-19584

Summary

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query which will be evaluated at elevated permissions if the notebook's backup is subsequently restored.

Affected Software

Weaknesses

• CWE-1336: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
• CWE-94: CWE-94: Improper Control of Generation of Code ('Code Injection')

Workarounds

Inspect the backup zip before restoring it to ensure it does not include malicious notebook contents. Do not automatically restore backup from untrusted sources.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• http://docs.velociraptor.app/announcements/advisories/cve-2026-19584/
• https://github.com/Velocidex/velociraptor/pull/4967

• ←Previous
• Next→