Skip to content

Commit b3f7201

Browse files
scudettescudette
authored
Added 0.76.3 release to address CVE 2026-6290 (Velocidex#1232)
1 parent bae1c20 commit b3f7201

16 files changed

Lines changed: 423 additions & 33 deletions

File tree

‎.wordlist.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2088,3 +2088,7 @@ subsetted
20882088
unannotated
20892089

20902090
addClass
2091+
2092+
Reindex
2093+
reindex
2094+
reindexed

‎content/_index.md‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -40,13 +40,18 @@ navs:
4040

4141
{{% navs %}}
4242

43-
{{% notice warning "CVE-2026-5329 published on 2026-04-08" %}}
4443

45-
Velociraptor versions before 0.76.2 improperly validated input in
46-
client message handler. This could lead to remote code execution on
47-
the server.
44+
{{% notice warning "Current Security Advisories" %}}
4845

49-
Read the [Full announcement](/announcements/advisories/cve-2026-5329/) and upgrade immediately.
46+
* [Velociraptor versions before
47+
0.76.3](/announcements/advisories/cve-2026-6290/) contain a
48+
vulnerability in the query() plugin which allows access to all orgs
49+
with the user's current ACL token.
50+
51+
* [Velociraptor versions before
52+
0.76.2](/announcements/advisories/cve-2026-5329/) improperly
53+
validated input in client message handler. This could lead to remote
54+
code execution on the server.
5055

5156
{{% /notice %}}
5257

‎content/announcements/advisories/CVE-2026-5329/CVE-2026-5329.html‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,13 +76,17 @@
7676
Velociraptor server.
7777
</p>
7878
<p>
79-
Rapid7 Hosted Velociraptor instances are not affected by this vulnerability.
79+
Rapid7 Hosted Velociraptor instances are not affected by this
80+
vulnerability.
8081
</p>
8182
</div>
8283
<div id="configs">
8384
<h2>Required configuration for exposure:
8485
</h2>
85-
<p>This vulnerability only affects the Velociraptor server, which is typically running on a Linux system </p>
86+
<p>
87+
This vulnerability only affects the Velociraptor server, which
88+
is typically running on a Linux system.
89+
</p>
8690
</div>
8791

8892
<div id="problem">
@@ -139,7 +143,7 @@ <h2>Product Status:
139143
</span>
140144
</td>
141145
<td>
142-
before 0.76.2
146+
before 0.76.3
143147
<br> before 0.75.7
144148
</td>
145149
</tr>
@@ -150,7 +154,11 @@ <h2>Product Status:
150154
<div class="rnd pad sec vgap" id="credits">
151155
<h2>Credits:
152156
</h2>
153-
<p>We thank Chris Au from NyxLab for identifying and reporting this issue responsibly
157+
<p>We thank Chris Au from NyxLab for identifying and reporting
158+
this issue responsibly
159+
</p>
160+
<p>We thank [@s4vvi](https://s4vvi.com/) for reporting the
161+
deficiency with the patch on master/minion systems.
154162
</p>
155163
</div>
156164
<div id="references">

‎content/announcements/advisories/CVE-2026-5329/_index.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,14 @@ no_children: true
1414

1515
{{< include-html "CVE-2026-5329.html" >}}
1616

17+
{{% notice warning "Master/Minion systems" %}}
18+
19+
A shortcoming was reported in the 0.76.2 patch which did not properly
20+
account for master/minion systems. If you are running this
21+
configuration, please upgrade to version 0.76.3.
22+
23+
{{% /notice %}}
24+
1725
## Recommendation
1826

1927
This is a critical vulnerability, which can not be mitigated through

‎content/announcements/advisories/CVE-2026-6290/CVE-2026-6290.html‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
<div class="cve">
2+
<p>
3+
<span>Published
4+
</span>on 2026-04-08
5+
</p>
6+
<p>
7+
</p>
8+
<details class="popup">
9+
<summary class="lbl rnd sec CVSS MEDIUM">CVSS · HIGH · 8.0
10+
<sub>⁄10
11+
</sub>
12+
<span style="font-size:0px;opacity:0"> · CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
13+
</span>
14+
</summary>
15+
<div class="pop wht rnd shd pad bor">
16+
<span>Scoring scenario:
17+
</span>GENERAL
18+
<div>attackVector:
19+
<b>NETWORK
20+
</b>
21+
</div>
22+
<div>attackComplexity:
23+
<b>HIGH
24+
</b>
25+
</div>
26+
<div>privilegesRequired:
27+
<b>HIGH
28+
</b>
29+
</div>
30+
<div>userInteraction:
31+
<b>NONE
32+
</b>
33+
</div>
34+
<div>scope:
35+
<b>CHANGED
36+
</b>
37+
</div>
38+
<div>confidentialityImpact:
39+
<b>HIGH
40+
</b>
41+
</div>
42+
<div>integrityImpact:
43+
<b>HIGH
44+
</b>
45+
</div>
46+
<div>availabilityImpact:
47+
<b>HIGH
48+
</b>
49+
</div>
50+
<div>
51+
<a class="vgi-dial" href="https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H" target="_blank">Open CVSS Calc
52+
</a>
53+
</div>
54+
</div>
55+
</details>
56+
<p>
57+
</p>
58+
<div id="description">
59+
<p>
60+
Velociraptor versions prior to 0.76.3 contain a vulnerability in
61+
the query() plugin which allows access to all orgs with the
62+
user's current ACL token.
63+
<p>
64+
This allows an authenticated GUI user with access in one org, to
65+
use the query() plugin, in a notebook cell, to run VQL queries
66+
on other orgs which they may not have access to. The user's
67+
permissions in the other org are the same as the permissions
68+
they have in the org containing the notebook.
69+
</p>
70+
</div>
71+
<div id="problem">
72+
<h2>Problem:
73+
</h2>
74+
<p>CWE-863: Incorrect Authorization
75+
<a href="https://cwe.mitre.org/data/definitions/863" target="_blank">
76+
<small>CWE-863</small>
77+
</a>
78+
<br>
79+
</p>
80+
</div>
81+
<div id="impact">
82+
<h2>Impact:
83+
</h2>
84+
<p>CAPEC-114: Authentication Abuse
85+
<a href="https://capec.mitre.org/data/definitions/114.html" target="_blank">
86+
<small>CAPEC-114
87+
</small>
88+
</a>
89+
<br>
90+
</p>
91+
</div>
92+
<div id="status">
93+
<h2>Product Status:
94+
</h2>
95+
<table class="striped">
96+
<colgroup>
97+
<col>
98+
<col class="affectedCol">
99+
</colgroup>
100+
<thead>
101+
<tr>
102+
<th>Product
103+
</th>
104+
<th>Affected
105+
</th>
106+
</tr>
107+
</thead>
108+
<tbody>
109+
<tr>
110+
<td rowspan="1">
111+
<b class="vgi-package">Rapid7 Velociraptor
112+
</b>
113+
<i> on
114+
</i>
115+
<span class="vgi-stack">Linux
116+
</span>
117+
<br>
118+
<a class="vgi-ext" href="https://github.com/Velocidex/velociraptor">source repo
119+
</a>
120+
<br>
121+
<span class="vgi-impact">Default status is unaffected
122+
</span>
123+
</td>
124+
<td>
125+
before 0.76.3
126+
<br> before 0.75.8
127+
</td>
128+
</tr>
129+
</tbody>
130+
</table>
131+
<br style="font-size:0;">
132+
</div>
133+
<div class="rnd pad sec vgap" id="credits">
134+
<h2>Credits:
135+
</h2>
136+
<p>We thank Faisal Alhumaid for reporting this issue responsibly.
137+
</p>
138+
</div>
139+
<div id="references">
140+
<h2>References
141+
</h2>
142+
<p>
143+
</p>
144+
<div>
145+
<a href="https://docs.velociraptor.app/announcements/advisories/cve-2026-5329/">docs.velociraptor.app/announcements/advisories/cve-2026-5329/
146+
</a>
147+
</div>
148+
<p>
149+
</p>
150+
</div>
151+
</div>

‎content/announcements/advisories/CVE-2026-6290/_index.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
menutitle: "CVE-2026-6290"
3+
title: "CVE-2026-6290 Velociraptor query() plugin misapplies permissions to orgs"
4+
description: |
5+
Velociraptor versions prior to 0.76.3 contain a vulnerability in the
6+
query plugin which allows access to all orgs with the user's current ACL token.
7+
8+
weight: 9
9+
date: 2026-04-07T00:00:00Z
10+
no_edit: true
11+
noTitle: false
12+
no_children: true
13+
---
14+
15+
{{< include-html "CVE-2026-6290.html" >}}
16+
17+
## Required configuration for exposure:
18+
19+
This issue affects deployments relying on org separation to contain
20+
untrusted users to a subset of orgs.
21+
22+
Most Velociraptor users use multiple Orgs to separate different
23+
environments but have the same group of trusted users with access to
24+
all orgs. In this case, this vulnerability does not apply since all
25+
users have the same permissions on all orgs.
26+
27+
## Recommendation
28+
29+
You can disable the query() plugin by [adding the following
30+
YAML](/docs/deployment/references/#security.denied_plugins) to your
31+
`server.config.yaml`
32+
33+
```yaml
34+
security:
35+
denied_plugins:
36+
- query
37+
```
38+
39+
40+
To remediate, you will need to [upgrade your
41+
server](/docs/deployment/server/upgrades/#upgrading-a-server-in-place-upgrade)
42+
to the latest version of your release:
43+
44+
* For 0.76 releases, upgrade immediately to [v0.76.3](https://github.com/Velocidex/velociraptor/releases/download/v0.76/velociraptor-v0.76.3-linux-amd64)
45+
* For 0.75 releases, upgrade immediately to [v0.75.8](https://github.com/Velocidex/velociraptor/releases/download/v0.75/velociraptor-v0.75.8-linux-amd64)

‎content/docs/deployment/orgs/_index.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,18 @@ Once the new org is created you can assign users to the Org using the
121121
[Adding a New User]({{% ref
122122
"/docs/deployment/security/#adding-a-new-user" %}}) procedure.
123123

124+
#### Org Security
125+
126+
Although users are separated from accessing different orgs using org
127+
specific ACLs, in most Velociraptor deployments, this is a soft
128+
separation. There are many available ways in which a malicious user
129+
may access an org that they have no ACLs to. Generally we recommend
130+
not providing untrusted users access to the Velociraptor GUI at all,
131+
even if they should be restricted to a small set of orgs.
132+
133+
See this for a full discussion of [Org
134+
Security](/docs/deployment/security/#managing-org-access).
135+
124136
### Preparing client deployment for the new Org
125137

126138
Clients are configured to connect to one org only. While the

‎content/docs/deployment/security/_index.md‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -823,3 +823,79 @@ by the user that initiates the collection.
823823

824824

825825
{{% /notice %}}
826+
827+
828+
## Managing org access
829+
830+
Velociraptor provides ACL separation to users based on an org (or
831+
tenant) model. This means the same user may have different ACLs in
832+
different orgs - they may only have read access in one org and full
833+
admin access in another org.
834+
835+
While this is convenient, it is not enough to provide complete
836+
separation to untrusted users.
837+
838+
If an untrusted user has access to one org but does not have access to
839+
another, there are multiple ways which allow the user to read/modify
840+
data in the other org:
841+
842+
### Shelling out
843+
844+
By default, users have access to the `execve()` plugin providing they
845+
have the `EXECVE` permission (normally given to administrators). This
846+
allows an administrator in one org to run arbitrary code on the
847+
server - which may allow them to just read the file store of another
848+
org.
849+
850+
You may disable the `execve()` plugin using the [configuration
851+
file](/docs/deployment/references/#security.denied_plugins)
852+
853+
```yaml
854+
security:
855+
denied_plugins:
856+
- execve
857+
```
858+
859+
### Accessing files directly
860+
861+
Velociraptor org data are stored on disk in separate directories. This
862+
means that users that have access to the `file` accessor can simply
863+
read the other org's data bypassing the ACLs.
864+
865+
For example, the following query will read all orgs datastore files:
866+
867+
```vql
868+
SELECT * FROM glob(globs="/opt/velociraptor/orgs/**")
869+
```
870+
871+
In recent versions of Velociraptor, it is possible to restrict the
872+
operation of the `file` accessor using the [configuration
873+
file](/docs/deployment/references/#security.denied_file_accessor_prefix). The
874+
following stops direct file access to the `/opt/velociraptor/`
875+
directory. On Linux many files can be read using the `/proc/`
876+
filesystem too. A more restrictive deployment will have more paths
877+
here.
878+
879+
```yaml
880+
security:
881+
denied_file_accessor_prefix:
882+
- /opt/velociraptor/
883+
- /etc/
884+
- /proc/
885+
```
886+
887+
Other accessors may provide access to different orgs in some
888+
situations. For example when running the server as root, the `ext4` or
889+
`ntfs` accessors may allow direct reading of the filesystem
890+
inode. Usually we recommend running the server on Linux as a non-root
891+
user to prevent these issues.
892+
893+
In summary, although it is possible to restrict user access to
894+
different orgs this should be considered best effort. Much thought is
895+
required to truly isolate an untrusted user to some orgs, preventing
896+
access to other orgs. The recommendation is to avoid giving untrusted
897+
and potentially malicious users to the Velociraptor GUI at all.
898+
899+
If you require true data isolation between orgs, we recommend to spin
900+
up a separate Velociraptor instance (Virtual Machine or container) for
901+
each unique deployment.

0 commit comments

Comments
 (0)