CVE-2026-6290
published 2026-04-15CVE-2026-6290: Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This…
PriorityP351critical9.1CVSS 3.1
AVNACLPRHUINSCCHIHAH
EPSS
0.22%
12.9th percentile
Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are
the same as the permissions they have in the org containing the notebook.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rapid7 | velociraptor | < 0.76.3, 0.75.8 | 0.76.3, 0.75.8 |
| rapid7 | velociraptor | < 0.76.3 | 0.76.3 |
| www.velocidex.com | golang_velociraptor | 0 – 0.76.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hv5g-26jg-pc45: Velociraptor versions prior to 0
ghsa_unreviewed·2026-04-15
CVE-2026-6290 [HIGH] CWE-863 GHSA-hv5g-26jg-pc45: Velociraptor versions prior to 0
Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are
the same as the permissions they have in the org containing the notebook.
VulDB
Rapid7 Velociraptor up to 0.75.7/0.76.2 query authorization (EUVD-2026-22995)
vuldb·2026-04-15·CVSS 8.0
CVE-2026-6290 [HIGH] Rapid7 Velociraptor up to 0.75.7/0.76.2 query authorization (EUVD-2026-22995)
A vulnerability identified as problematic has been detected in Rapid7 Velociraptor up to 0.75.7/0.76.2. Affected by this issue is the function Query. Performing a manipulation results in incorrect authorization.
This vulnerability is known as CVE-2026-6290. Remote exploitation of the attack is possible. No exploit is available.
You should upgrade the affected component.
GHSA
Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token
ghsa·2026-04-15
CVE-2026-6290 [HIGH] CWE-863 Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token
Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token
Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are
the same as the permissions they have in the org containing the notebook.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-15
Published