CVE-2022-35629 Velociraptor Client ID Spoofing
An attacker can spoof client IDs to impersonate other clients, bypassing authentication and potentially modifying data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-35629?
CVE-2022-35629 is a medium-severity authentication bypass vulnerability in Rapid7 Velociraptor, published on 29 Jul 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Due to a bug in the handling of the communication between the client and server, it was possible for one client, already registered with their own client ID, to send messages to the server claiming to come from another client ID. This issue was resolved in Velociraptor 0.6.5-2.
Which versions are affected by CVE-2022-35629?
It affects 1 product.
Products include Rapid7 Velociraptor.
How do I fix CVE-2022-35629?
No fix has been published for CVE-2022-35629 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-35629 being exploited?
There is no known exploitation of CVE-2022-35629 in the wild and no public exploit code.
Other vulnerabilities in Rapid7 Velociraptor
- CVE-2023-0242 Insufficient permission check in the VQL copy() function
- CVE-2023-5950 Rapid7 Velociraptor Reflected XSS
- CVE-2026-5329 Rapid7 Velociraptor Improper Input Validation in Client Message Handler
- CVE-2026-6290 Velociraptor Query() Plugin Misapplies Permissions To Orgs
- CVE-2025-14728 Rapid7 Velociraptor Directory Traversal Vulnerability
Sources
Also known as GHSA-77f9-jv8v-xrjp.