CVE-2026-19200CWE-862CWE-94broken-access-controlcode-injection

CVE-2026-19200

High · published August 24, 2026

CVSS v3.1
8.9
EPSS
0%
Percentile
12.8
In the wild
Unconfirmed
What it is

The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions.  The attacker need only have the NOTEBOOK_EDIT permission (e.g. an analyst role) to be able to call this function.

The record
Technical detail
CVSS v3.1
8.9 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00228 · 12.8th percentile
Weaknesses
CWE-862 · Missing Authorization; CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-24T08:16Z
References (2)
http://docs.velociraptor.app/announcements/advisories/cve-2026-19200/ · [email protected]https://github.com/Velocidex/velociraptor/pull/4962 · [email protected]
EPSS history
Timeline
  • 24 AUG 03:22Z
    Velociraptor Analyst overwrites live built-in artifacts through verify()
    cvelistv5