CVE-2026-6290

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6290", "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "state": "PUBLISHED", "assignerShortName": "rapid7", "dateReserved": "2026-04-14T17:31:37.803Z", "datePublished": "2026-04-15T17:29:04.306Z", "dateUpdated": "2026-04-16T03:55:38.112Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7", "dateUpdated": "2026-04-15T17:29:04.306Z"}, "title": "Velociraptor Query() Plugin Misapplies Permissions To Orgs", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-863", "description": "CWE-863", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Authentication Abuse"}]}], "affected": [{"vendor": "Rapid7", "product": "Velociraptor", "versions": [{"status": "affected", "version": "0", "lessThan": "0.76.3, 0.75.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are\nthe same as the permissions they have in the org containing the notebook.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are<br>the same as the permissions they have in the org containing the notebook."}]}], "references": [{"url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-6290/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Faisal Alhumaid", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-6290"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T03:55:38.112Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6290", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-15T17:47:54.141640Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T17:55:55.350Z"}}], "cna": {"title": "Velociraptor Query() Plugin Misapplies Permissions To Orgs", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Faisal Alhumaid"}], "impacts": [{"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Authentication Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Rapid7", "product": "Velociraptor", "versions": [{"status": "affected", "version": "0", "lessThan": "0.76.3, 0.75.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-6290/"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are\nthe same as the permissions they have in the org containing the notebook.", "supportingMedia": [{"type": "text/html", "value": "Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are<br>the same as the permissions they have in the org containing the notebook.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863"}]}], "providerMetadata": {"orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7", "dateUpdated": "2026-04-15T17:29:04.306Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6290", "state": "PUBLISHED", "dateUpdated": "2026-04-16T03:55:38.112Z", "dateReserved": "2026-04-14T17:31:37.803Z", "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "datePublished": "2026-04-15T17:29:04.306Z", "assignerShortName": "rapid7"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Velociraptor", "vendor": "Rapid7", "versions": [{"lessThan": "0.76.3, 0.75.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cve@rapid7.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*", "matchCriteriaId": "B37A5BCF-3973-4A07-81BC-D0B05EFEBFD9", "versionEndExcluding": "0.76.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are\nthe same as the permissions they have in the org containing the notebook."}, {"lang": "es", "value": "Las versiones de Velociraptor anteriores a la 0.76.3 contienen una vulnerabilidad en el plugin query() que permite el acceso a todas las organizaciones con el token ACL actual del usuario. Esto permite a un usuario de GUI autenticado con acceso en una organizaci\u00f3n usar el plugin query(), en una celda de cuaderno, para ejecutar consultas VQL en otras organizaciones a las que quiz\u00e1s no tenga acceso. Los permisos del usuario en la otra organizaci\u00f3n son los mismos que los permisos que tiene en la organizaci\u00f3n que contiene el cuaderno."}], "id": "CVE-2026-6290", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 6.0, "source": "cve@rapid7.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6290", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-04-15T18:17:25.030", "references": [{"source": "cve@rapid7.com", "tags": ["Vendor Advisory"], "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-6290/"}], "sourceIdentifier": "cve@rapid7.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "cve@rapid7.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.76.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.75.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Velociraptor", "source": "cna", "vendor": "Rapid7"}, "product": "velociraptor", "vendor": "rapid7"}], "analysis": {"en": {"generated_at": "2026-04-15T19:15:05.966101+00:00", "value": {"mitigation_remediation": ["Upgrade Velociraptor to version 0.76.3 or later, which contains the patch for the query() plugin bug.", "Restrict or monitor the use of the query() plugin by users who do not need cross\u2011organization access, for example by assigning stricter role\u2011based permissions to notebook sessions.", "If an immediate upgrade is not possible, disable the query() plugin for users lacking cross\u2011org privileges or remotely revoke their ACL token before allowing notebook execution in a different organization."], "summary": {"action": "Apply Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Rapid7 Velociraptor installations running any version earlier than 0.76.3 are affected. The issue is present in all releases prior to 0.76.3; upgrading to 0.76.3 or later eliminates the flaw.", "description_and_impact": "The vulnerability resides in the Velociraptor query() plugin, where an authenticated GUI user can supply a VQL query in a notebook cell that unintentionally ignores the intended organization boundaries. A user who has permission in one organization can execute arbitrary queries against any other organization using the same ACL token, effectively bypassing the normal access controls. This allows the user to read or manipulate data that they should not have access to, compromising the confidentiality and integrity of data across multiple organizations.", "risk_and_exploitability": "The CVSS base score is 8, indicating a high severity vulnerability. While the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the presence of an authenticated GUI user who already has access to at least one organization makes the attack vector realistic. An attacker could leverage this weakness to increase their privilege scope across other organizations without requiring additional credentials. The risk is therefore significant for environments where multiple independent organizations share a Velociraptor instance."}}}}, "created": "2026-04-15T19:15:12.062002+00:00", "updated": "2026-04-15T21:45:14.061963+00:00", "vendors": ["rapid7", "rapid7$PRODUCT$velociraptor"]}