CVE-2026-5329 Velociraptor improper input validation in client message handler

Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring message handler on the Velociraptor server (primarily Linux).

This allows an authenticated remote attacker (i.e. a rogue client) to write to arbitrary internal server queues via a crafted monitoring message with a malicious queue name.

The server handler that receives client monitoring messages does not sufficiently validate the queue name supplied by the client, allowing a rogue client to write arbitrary messages to privileged internal queues.

This vulnerability may lead to remote code execution on the Velociraptor server.

Rapid7 Hosted Velociraptor instances are not affected by this vulnerability.

Required configuration for exposure:

This vulnerability only affects the Velociraptor server, which is typically running on a Linux system

Problem:

CWE-1287: Improper Validation of Specified Type of Input CWE-1287

Impact:

CAPEC-253: Remote Code Inclusion CAPEC-23

Product Status:

References