CVE-2026-6290

Katalog CVE

CVSS 9.1 · Critical EPSS 0,39%

Kerentanan Incorrect Authorization pada rapid7 velociraptor. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are the same as the permissions they have in the org containing the notebook.

Rincian

Terbit di NVD

15 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.velociraptor.app/announcements/advisories/cve-2026-6290/ advisory vendor