CVE-2026-64952: Velociraptor Hunt Deletion With Insufficient Permission Check

Published on 2026-07-31 Vulnogram
CVSS · MEDIUM · 6.5 ⁄10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Scoring scenario: GENERAL
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
Description

The hunt_delete() VQL function allows deleting hunts. 

Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "investigator" role) instead of the "DELETE_RESULTS" permission (usually only assigned to "administrators").

Problem CWE-863: Incorrect Authorization
Required configuration for exposure The attacker should have at least COLLECT_CLIENT permission (investigator role)
ProductAffected
Rapid7 Velociraptor on Linux
source repo
Default status is unaffected 		before 0.77.2
Credits
  • Tristan Madani (Talence Security)
    •
References