https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 20:43:42 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-19072 <p>Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field &#34;compiled_collector_args&#34; is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who can schedule a hunt (minimal role of &#34;investigator&#34; ) to set the compiled VQL statements for the hunt bypassing any ACL checks that would normally be applied.</p> <p>This flaw can then be escalated to allow the &#34;investigator&#34; user to run arbitrary VQL statements as an administrator user on the Velociraptor server.</p> <p>Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field &#34;compiled_collector_args&#34; is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who can schedule a hunt (minimal role of &#34;investigator&#34; ) to set the compiled VQL statements for the hunt bypassing any ACL checks that would normally be applied.</p> <p>This flaw can then be escalated to allow the &#34;investigator&#34; user to run arbitrary VQL statements as an administrator user on the Velociraptor server.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-19072 https://vulnerability.circl.lu/vuln/ghsa-5856-3m26-mvm4 <p>Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field &#34;compiled_collector_args&#34; is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who can schedule a hunt (minimal role of &#34;investigator&#34; ) to set the compiled VQL statements for the hunt bypassing any ACL checks that would normally be applied.</p> <p>This flaw can then be escalated to allow the &#34;investigator&#34; user to run arbitrary VQL statements as an administrator user on the Velociraptor server.</p> <p>Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field &#34;compiled_collector_args&#34; is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who can schedule a hunt (minimal role of &#34;investigator&#34; ) to set the compiled VQL statements for the hunt bypassing any ACL checks that would normally be applied.</p> <p>This flaw can then be escalated to allow the &#34;investigator&#34; user to run arbitrary VQL statements as an administrator user on the Velociraptor server.</p> https://vulnerability.circl.lu/vuln/ghsa-5856-3m26-mvm4