CVE Feed

    Dashboard / CVE / CVE-2026-78411

    CVE-2026-78411

    Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server admin.

    Published:Oct 5, 2026
    Last Modified:Oct 5, 2026
    EPS:Oct 5, 2026
    EPSS Score:
    CVSS Score:6.5

    Affected Products

    Vendor
    Rapid7
    Product
    Velociraptor

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-863 Incorrect Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-78413 (CVSS 5.5) — Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be u…
    CVE-2026-78412 (CVSS 4.9) — Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The …
    CVE-2026-77798 (CVSS 6.5) — Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from …
    CVE-2026-77797 (CVSS 3.6) — Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing ce…
    CVE-2026-19072 (CVSS 9.9) — Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts …
    CVE-2026-19584 (CVSS 7.7) — Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Vel…
    CVE-2026-19583 (CVSS 9.9) — Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys…
    CVE-2026-19200 (CVSS 8.9) — The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due …
    CVE-2026-15371 (CVSS 8.1) — Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell valu…
    CVE-2026-18652 (CVSS 6.5) — Velociraptor allows reading Stacked result sets from the GUI.  Velociraptor's multi-tenant design stores sub o…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High