CVE-2026-19583: Velociraptor Permission Bypass via Client Monitoring Artifacts

Overview

A critical permission-bypass vulnerability has been disclosed in Velociraptor, the open-source digital forensics and incident response (DFIR) endpoint monitoring platform maintained by Rapid7. Tracked as CVE-2026-19583, the flaw allows a low-privileged Velociraptor user to schedule sensitive, otherwise-restricted artifacts by disguising them as client monitoring artifacts.

Velociraptor gates certain high-risk artifacts behind additional access permissions. For example, the Linux.Sys.BashShell artifact — which allows arbitrary command execution on endpoints — requires the dedicated EXECVE permission before it can be scheduled. That check, however, was never applied to client monitoring artifacts, and the platform also failed to verify that artifacts submitted through the client monitoring path actually carried the expected CLIENT_EVENTS type.

The combination means any user permitted to schedule client monitoring artifacts — a comparatively low bar in many deployments — can smuggle in artifacts like Linux.Sys.BashShell that should require the far more sensitive EXECVE grant, achieving arbitrary command execution across every enrolled endpoint.

Technical Details

How It Works

Velociraptor's server enforces per-artifact permission checks so that operators without full administrative trust cannot run arbitrary commands on managed fleets. The EXECVE permission exists specifically to gate artifacts capable of process execution.

The client monitoring artifact scheduling path, used to push always-on telemetry collectors to endpoints, did not run artifacts through the same permission gate — and did not confirm the artifact being scheduled was actually of type CLIENT_EVENTS. An attacker (or malicious insider) with only client-monitoring scheduling rights can therefore register a command-execution artifact such as Linux.Sys.BashShell through that path, sidestepping the EXECVE requirement entirely and executing shell commands as the Velociraptor client process on every connected endpoint.

Impact Assessment

Who Is At Risk

Any organization running a Velociraptor server before version 0.77.2 with more than one tier of operator trust is exposed, including:

• MSSPs and SOC teams that grant analysts client-monitoring or telemetry-configuration rights without full admin access
• Multi-tenant DFIR deployments where lower-trust roles manage monitoring artifacts
• Environments where the artifact-scheduling role was assumed to be a safe, low-privilege delegation

Potential Attack Chains

1. Abuse of Delegated Access — A user with client-monitoring scheduling rights (but not EXECVE) schedules a disguised command-execution artifact.
2. Fleet-Wide Command Execution — The artifact is pushed to and runs on every endpoint enrolled with the Velociraptor client.
3. Privilege Escalation — Command execution on managed endpoints can be used to harvest credentials, deploy further tooling, or pivot deeper into the environment.
4. Trust Abuse in DFIR Tooling — Because Velociraptor is itself an incident-response platform, compromise of its command channel can undermine active investigations.

Mitigation

Immediate Actions

• Upgrade to Velociraptor 0.77.2 or later, which enforces the EXECVE permission check on client monitoring artifacts and validates the CLIENT_EVENTS artifact type.
• Audit operator roles and revoke client-monitoring scheduling rights from any account that should not be able to execute commands on endpoints.
• Review artifact scheduling history in the Velociraptor server for any CLIENT_EVENTS-labelled artifacts that actually reference command-execution artifacts like Linux.Sys.BashShell.

Detection Opportunities

• Search Velociraptor server audit logs for client-monitoring artifact updates that reference Linux.Sys.BashShell or other EXECVE-gated artifacts.
• Flag any monitoring artifact configuration change made by an account without explicit EXECVE privileges.
• Monitor endpoint process trees for unexpected shell invocations originating from the Velociraptor client agent.

Defence-in-Depth

• Apply least-privilege role design for all Velociraptor operators — avoid broad "monitoring" roles that implicitly carry execution capability.
• Segment high-trust administrative access from delegated telemetry-management roles.
• Enable comprehensive server-side audit logging and forward it to a separate SIEM outside the Velociraptor deployment itself.

Background

Velociraptor is widely used by incident responders and managed security providers for endpoint visibility and forensic collection at scale. Because its own command channel carries administrative trust across an entire fleet, permission-model flaws like CVE-2026-19583 are especially consequential — a bypass doesn't just expose one host, it can hand an attacker execution rights across every endpoint the platform manages.

The vulnerability was credited to researchers Yuval Miller and Leon Kayaliev and disclosed alongside a GitHub Security Advisory and vendor documentation from Rapid7.

References

• NVD — CVE-2026-19583
• GitHub Advisory — GHSA-jfjq-fc5j-227m
• Velociraptor Security Advisory — CVE-2026-19583