CVE-2026-64952: Velociraptor Hunt Deletion With Insufficient Permission Check
Published on 2026-07-31
Vulnogram
CVSS · MEDIUM · 6.5 ⁄10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Scoring scenario:
GENERAL
attackVector:
NETWORK
attackComplexity:
LOW
privilegesRequired:
LOW
userInteraction:
NONE
scope:
UNCHANGED
confidentialityImpact:
NONE
integrityImpact:
HIGH
availabilityImpact:
NONE
Description
The hunt_delete() VQL function allows deleting hunts.
Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "investigator" role) instead of the "DELETE_RESULTS" permission (usually only assigned to "administrators").
Problem
CWE-863: Incorrect Authorization
Required configuration for exposure
The attacker should have at least COLLECT_CLIENT permission (investigator role)
| Product | Affected |
|---|---|
| Rapid7 Velociraptor on
Linux
source repo Default status is unaffected |
before 0.77.2 |
Credits
- Tristan Madani (Talence Security)