CVE-2026-19200 Rapid7 CVE debrief

Who should care

Defenders responsible for Velociraptor deployments, particularly those with analyst roles or NOTEBOOK_EDIT permissions, should assess exposure and verify configurations. Security teams managing Velociraptor installations should prioritize verifying configurations, monitoring for suspicious activity, and restricting access to sensitive functions. Additionally, operators and platform administrators should be aware of the potential risks and take steps to mit

Why it matters

CVE-2026-19200 allows unauthorized artifact overwrite in Velociraptor, impacting deployments with users having NOTEBOOK_EDIT permission. Defenders should verify configurations, monitor activity, and restrict access.

• Potential unauthorized modification of artifacts
• Elevation of privileges for users with NOTEBOOK_EDIT permission
• Possible disruption of Velociraptor functionality
• Need for verification of Velociraptor configurations and monitoring

Technical summary

The Velociraptor verify() VQL function allows users to verify artifacts for syntactic and other issues. However, due to an implementation fault, it uses the global artifact repository, enabling callers to overwrite existing artifacts without required permissions. This flaw can be exploited by users with NOTEBOOK_EDIT permission, typically held by analyst roles, potentially disrupting Velociraptor functionality. The vulnerability highlights the need for proper configuration and access control in Velociraptor environments.

Defensive priority

Defenders should prioritize verifying Velociraptor configurations and monitoring for suspicious activity

Recommended defensive actions

• Verify Velociraptor configurations to ensure proper permissions are set for all users.
• Monitor for suspicious activity related to artifact modifications and changes.
• Restrict access to the NOTEBOOK_EDIT permission to authorized analyst roles.
• Review compensating controls for exposed systems while remediation is scheduled.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Conduct a thorough review of Velociraptor deployments to identify potential exposure.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Velociraptor's verify() VQL function, which uses the global artifact repository and allows unauthorized artifact overwrite. The flaw requires only NOTEBOOK_EDIT permission, typically held by analyst roles. Evidence is limited to public CVE and NVD information, with no additional source details available for verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.