CVE-2026-19583

    Dashboard / Vulnerabilities / CVE-2026-19583

    CVE-2026-19583

    Published: 10 Sept 2026Last Modified: 12 Sept 2026

    Summary: Velociraptor Required Permissions bypass by using client monitoring queries

    Details: Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring artifacts. Additionally there was no requirement that client monitoring artifacts carry the CLIENT_EVENTS type. This allows any user who can schedule client monitoring artifacts to also schedule otherwise restricted artifacts (such as Linux.Sys.BashShell).

    References: http://docs.velociraptor.app/announcements/advisories/cve-2026-19583/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19583.json, https://nvd.nist.gov/vuln/detail/CVE-2026-19583, https://github.com/Velocidex/velociraptor/pull/4967, https://github.com/Velocidex/velociraptor

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c0c9dd609140139efcb37c47e2afa79ed57e6c84

    Affected versions

    v0.77.1
    v0.77.1-rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-19583 | CVE-DB