Velocidex Velociraptor has an off-by-one error

Description

References

• nvd.nist.gov/vuln/detail/CVE-2026-7572 · ADVISORY
• docs.velociraptor.app/announcements/advisories/cve-2026-7572 · WEB
• Velocidex/velociraptor · PACKAGE
• docs.velociraptor.app/announcements/advisories/cve-2026-7572 · Vendor Advisory
• GitHub Advisory GHSA-6cmp-qv2f-x97x · ADVISORY

More vulnerabilities in www.velocidex.com/golang/velociraptor

• CVE-2026-6863MEDIUM 6.8Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in…
• CVE-2026-7573HIGH 7.7An authorization bypass (CWE-639) in the GetUserRoles gRPC API endpoint in Velocidex Velociraptor below version 0.76.5 allows any authentica…
• CVE-2026-6290CRITICAL 9.1Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current …
• CVE-2025-6264MEDIUM 5.5Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually…
• CVE-2023-0290MEDIUM 4.3Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where t…