CVE-2026-5329 Rapid7 Velociraptor Improper Input Validation in Client Message Handler

High 8.5 Published 9 Apr 2026 Updated 16 Apr 2026

An authenticated attacker can achieve remote code execution on the Velociraptor server by sending crafted monitoring messages with malicious queue names.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-5329?

CVE-2026-5329 is a high-severity code injection vulnerability in Rapid7 Velociraptor, published on 9 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring message handler on the Velociraptor server (primarily Linux) that allows an authenticated remote attacker to write to arbitrary internal server queues via a crafted monitoring message with a malicious queue name. The server handler that receives client monitoring messages does not sufficiently validate the queue name supplied by the client, allowing a rogue client to write arbitrary messages to privileged internal queues. This may lead to remote code execution on the Velociraptor server. Rapid7 Hosted Velociraptor instances are not affected by this vulnerability.

Weakness: CWE-20

Which versions are affected by CVE-2026-5329?

It affects 1 product.

Products include Rapid7 Velociraptor.

How do I fix CVE-2026-5329?

Upgrade to a fixed version.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-5329 being exploited?

There is no known exploitation of CVE-2026-5329 in the wild and no public exploit code.

Sources

Also known as GHSA-3wq5-x8p8-2v3p.