CVE-2026-19583

Name of the Vulnerable Software and Affected Versions Velociraptor (affected versions not specified)

Description Certain sensitive artifacts are intended to be restricted by additional permissions to prevent unauthorized actions. For instance, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints and requires the EXECVE permission. However, a flaw exists where client monitoring artifacts do not undergo these permission checks, nor is there a requirement for them to carry the CLIENT EVENTS type. This allows users with permissions to schedule client monitoring artifacts to bypass restrictions and schedule sensitive artifacts like Linux.Sys.BashShell.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.