CVE Feed

    Dashboard / CVE / CVE-2026-64952

    CVE-2026-64952

    The hunt_delete() VQL function allows deleting hunts.  Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "investigator" role) instead of the "DELETE_RESULTS" permission (usually only assigned to "administrators").

    Published:Aug 12, 2026
    Last Modified:Aug 12, 2026
    EPS:Aug 12, 2026
    EPSS Score:0.00299
    CVSS Score:6.5

    Affected Products

    Vendor
    Rapid7
    Product
    Velociraptor

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-863 Incorrect Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-19584 (CVSS 7.7) — Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Vel…
    CVE-2026-19583 (CVSS 9.9) — Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys…
    CVE-2026-19200 (CVSS 8.9) — The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due …
    CVE-2026-15371 (CVSS 8.1) — Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell valu…
    CVE-2026-18652 (CVSS 6.5) — Velociraptor allows reading Stacked result sets from the GUI.  Velociraptor's multi-tenant design stores sub o…
    CVE-2026-64951 (CVSS 3.5) — A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the fil…
    CVE-2026-64955 (CVSS 6.1) — When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, givi…
    CVE-2026-64954 (CVSS 8.2) — Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new coll…
    CVE-2026-18639 (CVSS 7.3) — When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. …
    CVE-2026-18638 (CVSS 6.5) — Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire ser…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High