Velociraptor CVE-2026-19583: Permission Bypass Can Enable Endpoint Command Execution

By AiCybr Editorial · Published September 16, 2026

Rapid7 disclosed CVE-2026-19583, a critical authorization flaw in Velociraptor that can let a user with investigator-level access schedule restricted client artifacts through the client-monitoring path. The vendor assigns the vulnerability a CVSS 3.1 score of 9.9 and identifies Velociraptor versions earlier than 0.77.2 as affected.

The vulnerable path matters because Velociraptor uses additional permissions to gate sensitive artifacts. The vendor cites Linux.Sys.BashShell as an example: the artifact can execute arbitrary commands on endpoints and normally requires the EXECVE permission. CVE-2026-19583 bypasses that control when the artifact is scheduled through client monitoring.

Velociraptor 0.77.2 contains the fix. Exploitation requires authenticated application access: the vendor specifies at least the investigator role plus the ability to add a client-monitoring artifact in the graphical interface. Successful abuse can cross the intended authorization boundary and reach command execution on monitored Linux endpoints.

CVE-2026-19583 at a glance

How the permission bypass works

Velociraptor organizes endpoint collection and response actions around artifacts. Sensitive artifacts can carry additional permission requirements, separating routine investigative access from higher-risk actions.

Linux.Sys.BashShell is one such artifact. Velociraptor normally requires the EXECVE permission before a user can schedule it because the artifact can launch commands on an endpoint.

The vulnerable client-monitoring path failed to enforce the same required-permission check. It also failed to require that a client-monitoring artifact carry the CLIENT_EVENTS type. As a result, a user who could configure client monitoring could place an otherwise restricted artifact into that workflow.

The security impact comes from the authorization transition:

1. the user has legitimate access to configure client monitoring;
2. the user selects an artifact that normally requires an additional permission;
3. the vulnerable path accepts the artifact without enforcing its required permission;
4. the artifact is scheduled for monitored clients;
5. a restricted operation can execute with capabilities the user's assigned role was intended to exclude.

Rapid7's advisory specifically identifies Linux.Sys.BashShell because it provides a clear route from the authorization bypass to arbitrary command execution on Linux endpoints.

Who is exposed

The vendor lists the required configuration as an attacker with at least the investigator role who can add a client-monitoring artifact in the GUI.

That exposure model makes role assignment and console access central to risk assessment. Environments deserve priority review when they have:

• multiple analysts or third-party responders with investigator access;
• shared Velociraptor administration across teams or customers;
• broad client-monitoring privileges delegated to non-administrators;
• Linux fleets where command-capable artifacts can reach sensitive servers or workstations;
• long-lived investigator accounts that may have outlived a specific incident or engagement.

The flaw is especially relevant to DFIR platforms because investigative systems commonly hold broad visibility and collection authority across many endpoints. A permission bypass in the management plane can therefore affect systems well beyond the Velociraptor server itself.

Fixed version: Velociraptor 0.77.2

Rapid7 identifies 0.77.2 as the first unaffected version for CVE-2026-19583. Velocidex also publishes a velociraptor-server:0.77.2 container image through GitHub Container Registry.

Administrators should first inventory the running server version and deployment method. Common cases include native binaries, containerized servers and orchestrated deployments that pin an image tag.

For container deployments, verify that the workload is actually running the corrected image after the update. A changed deployment manifest or image tag is insufficient if an older pod, container or node continues to serve the environment.

For native installations, confirm the active binary version after restart and verify that automation, package pinning or rollback mechanisms cannot restore a pre-0.77.2 build.

Remediation checklist

A practical response sequence is:

1. Upgrade the Velociraptor server to 0.77.2 or later.
2. Verify the active runtime version after the service or container restarts.
3. Inventory investigator-level users and identify accounts allowed to configure client monitoring.
4. Review client-monitoring configurations for unexpected or unusually powerful artifacts.
5. Check for use of command-capable artifacts, especially Linux.Sys.BashShell, through client-monitoring workflows.
6. Review recent role and permission changes for analyst, responder and service accounts.
7. Examine administrative activity around client-monitoring changes during the period when an affected version was running.
8. Rotate or disable stale investigator accounts that no longer require access.
9. Retest delegated roles after the upgrade so normal investigative workflows still operate with the intended permissions.

The upgrade is the primary remediation because it restores the missing authorization enforcement in the affected path.

What to review for possible abuse

CVE-2026-19583 requires authenticated application access, so investigation should focus on who could modify client monitoring and what they scheduled.

Useful review targets include:

• additions or edits to client-monitoring artifacts;
• use of Linux.Sys.BashShell or other artifacts carrying elevated permission requirements;
• unusual client-monitoring changes from investigator accounts;
• administrative actions performed outside expected incident windows;
• activity by disabled, departed or third-party analyst accounts;
• command execution on Linux endpoints that corresponds with Velociraptor collection activity;
• changes that affect many clients simultaneously.

Organizations with centralized authentication should correlate Velociraptor activity with identity-provider, VPN and privileged-access logs. That correlation can help distinguish an authorized incident-response action from misuse of a valid investigator account.

Why CVSS reaches 9.9 despite requiring privileges

The CVSS vector includes low privileges required (PR:L) because an attacker needs an existing Velociraptor role. The score remains critical because the flaw can bypass an additional security boundary and affect confidentiality and integrity at high severity across monitored systems.

The vector also records scope changed (S:C), reflecting that the vulnerable authorization decision in Velociraptor can lead to consequences on separate managed endpoints. That distinction is important for environments where a central DFIR server has access to hundreds or thousands of clients.

Role design after patching

The vulnerability also provides a useful reason to review delegated DFIR permissions. Investigator access should be issued according to operational need, with stronger controls around functions that can affect entire endpoint groups.

Recommended controls include:

• separate routine hunting and command-execution privileges;
• time-bounded access for external incident-response teams;
• individual analyst identities instead of shared accounts;
• stronger authentication for the Velociraptor management interface;
• periodic review of client-monitoring definitions;
• alerting on high-impact artifact or monitoring changes;
• removal of dormant responder accounts after an engagement closes.

These measures reduce the value of a compromised or misused analyst account and improve attribution during incident review.

Related Velociraptor 0.77.2 security work

Velociraptor's advisory index identifies 0.77.2 as a security-focused release that fixes multiple vulnerabilities. CVE-2026-19583 is one of several security reasons for moving affected deployments to the patched release.

Administrators upgrading from older branches should review the complete 0.77.2 advisory set and release notes before deployment, particularly when the server supports multiple teams or uses custom artifacts and automation.

Bottom line

Velociraptor deployments earlier than 0.77.2 should be upgraded. CVE-2026-19583 allows an investigator-level user with client-monitoring access to bypass artifact permission checks and schedule operations that their assigned role was intended to restrict. The vendor's own example reaches Linux.Sys.BashShell, creating a direct path to command execution on monitored Linux endpoints.

The immediate operational priorities are straightforward: move to 0.77.2 or later, verify the running version, inspect client-monitoring changes made while an affected build was active, and review which identities retain investigator-level access.

Sources

• Velociraptor advisory: CVE-2026-19583
• Velociraptor security advisories
• Velocidex Velociraptor 0.77.2 container package
• Velociraptor fix PR #4967