Velociraptor Flaw Lets Analysts Overwrite Artifacts

The Velociraptor team disclosed CVE-2026-19200 on August 24 — a privilege escalation flaw in the DFIR platform’s verify() VQL function that lets users with analyst-level permissions overwrite artifacts they shouldn’t be able to touch.

CVSS score: 8.9 High.

The flaw

verify() is used to validate artifacts for syntax and other issues before they’re deployed. Due to an implementation fault, the function accesses the global artifact repository instead of a user-scoped context. Anyone holding the NOTEBOOK_EDIT permission — the analyst-tier role — can call verify() to silently overwrite any artifact in the global repository, bypassing the elevated permissions that operation is supposed to require.

Artifacts in Velociraptor are the VQL scripts that power your hunts, collection schedules, monitoring rules, and automated response workflows. Unauthorized writes to that layer are unauthorized writes to your detection logic.

What to do

Patch first. The vendor advisory identifies the fixed version. There’s no workaround that doesn’t break analyst workflows — removing NOTEBOOK_EDIT from everyone stops the attack surface but also stops your analysts from doing their jobs.

After patching:

• Audit NOTEBOOK_EDIT assignments. Analyst-role permissions often get granted broadly at deployment time and never reviewed. Tighten the list to only the accounts that genuinely need notebook editing access.
• Review your artifact repository. Check for unexpected modifications to server-side artifacts, especially anything that touches alerting, collection targeting, or response automation. If your Velociraptor instance has run with shared credentials or a loose permission model, treat any artifact touching critical detection logic as suspect until verified.

No exploitation in the wild has been reported as of August 24. Don’t wait anyway. DFIR tooling is a high-value target inside an environment — an attacker who already has analyst-level access and knows about this flaw can suppress detection before pivoting further.

Related: strongSwan 6.0.7 Patches Double-Free in IKE Auth · WeeChat Relay Flaw Exposes Auth to Timing Attack · TWINLOOT Hides C2 Inside Microsoft SharePoint