CVE-2026-64954

Name of the Vulnerable Software and Affected Versions Velociraptor (affected versions not specified)

Description Velociraptor allows scheduling new collections via VQL queries in notebooks. While scheduling a new collection typically requires the COLLECT CLIENT permission, this requirement is not enforced if a user executes a VQL query that resets the authorization provider. This flaw enables a user with the ability to run arbitrary VQL, typically assigned the analyst role, to launch new collections, which is a capability usually reserved for the investigator role, resulting in a privilege escalation from analyst to investigator.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.