CVE-2026-85737

Name of the Vulnerable Software and Affected Versions Velociraptor versions prior to 0.77.2

Description The SQLPlugin.Call function in vql/parsers/sql/sql.go fails to enforce FILESYSTEM READ or NETWORK checks before passing a caller-controlled connstring to sql.Open. This allows arbitrary outbound database connections. A rogue MySQL server can leverage attacker-controlled connection options to enable local-infile access, allowing it to request files readable by the Velociraptor server process, including root-readable files if the process is running as root. Additionally, a low-privilege analyst with ANY QUERY permissions can bypass the FILESYSTEM READ check by using the zero-permission data accessor and the ATTACH DATABASE command to create files.

Recommendations Update to version 0.77.2.