---
id: CVE-2026-19583
title: Velociraptor Required Permissions bypass by using client monitoring queries
summary: >-
  Velociraptor allows some sensitive artifacts to be gated by additional
  permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary
  command execution on endpoints, and so it requires the EXECVE permission to
  schedule. Howe…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-732
vendor: Rapid7
product: Velociraptor
affected:
  - Velociraptor < 0.77.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T00:00:00+00:00'
published: '2026-09-10'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T03:56:12.052Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-19583'
references:
  - url: 'http://docs.velociraptor.app/announcements/advisories/cve-2026-19583/'
    label: Velociraptor Advisory CVE-2026-19583
  - url: 'https://github.com/Velocidex/velociraptor/pull/4967'
    label: 'Velociraptor Fix PR #4967'
tags:
  - cve.org
epss: 0.006
epssPercentile: 0.46414
ingestedAt: '2026-09-11T16:45:47.926Z'
---

## Overview

Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring artifacts. Additionally there was no requirement that client monitoring artifacts carry the CLIENT_EVENTS type. This allows any user who can schedule client monitoring artifacts to also schedule otherwise restricted artifacts (such as Linux.Sys.BashShell).

## Affected

- `Velociraptor < 0.77.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.