Executive Summary

A critical vulnerability, CVE-2026-19200, with a CVSS score of 8.9, has been identified in Velociraptor, a tool used for artifact verification. This vulnerability allows users with the NOTEBOOK_EDIT permission (typically an analyst role) to overwrite existing artifacts without the necessary permissions, impacting the confidentiality and integrity of the system. The vulnerability affects Velociraptor versions prior to 0.77.2 on both Linux and Windows platforms.

Technical Analysis

The vulnerability is classified under CWE-94 (Code Injection) and CWE-862 (Missing Authorization). It resides in the `verify()` VQL function of Velociraptor, which is used for verifying artifacts for syntactic and other issues. Due to an implementation fault, this function utilizes the global artifact repository, allowing callers to overwrite existing artifacts without the required permissions. The attacker needs only the NOTEBOOK_EDIT permission to exploit this vulnerability.

How It Gets Exploited

An attacker with the NOTEBOOK_EDIT permission, typically assigned to an analyst role, can exploit this vulnerability. The exploitation scenario involves the attacker calling the `verify()` VQL function with a specially crafted artifact. This action triggers the vulnerability, allowing the attacker to overwrite existing artifacts in the global repository without proper authorization. As a result, the attacker can achieve high impact on the confidentiality and integrity of the system.

Impact Assessment

The vulnerability affects Velociraptor versions prior to 0.77.2 on Linux and Windows platforms. An attacker exploiting this vulnerability can lead to high impacts on confidentiality (C) and integrity (I), and low impact on availability (A), as per the CVSS v3.1 scoring (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L). The CVSS score provided is 8.9, indicating a high severity level.

Recommended Actions

To mitigate this vulnerability, it is recommended to update Velociraptor to version 0.77.2 or later. Additionally, review and restrict the NOTEBOOK_EDIT permission to only those who require it, and monitor for any suspicious activity related to artifact modifications.

Sources

- National Vulnerability Database (NVD) - Velociraptor Advisory: http://docs.velociraptor.app/announcements/advisories/cve-2026-19200/ - GitHub Pull Request: https://github.com/Velocidex/velociraptor/pull/4962