CVE-2026-64954 Velociraptor collect_client() Permissions Bypass
An analyst can bypass permission checks to launch client collections, escalating privileges to investigator level in Velociraptor.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64954?
CVE-2026-64954 is a high-severity vulnerability in Rapid7 Velociraptor, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider.
This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role.
Weakness: CWE-862
Which versions are affected by CVE-2026-64954?
How do I fix CVE-2026-64954?
Apply the vendor's patch.
Is CVE-2026-64954 being exploited?
There is no known exploitation of CVE-2026-64954 in the wild and no public exploit code.
Sources
Also known as GHSA-j6jv-j266-988h.