Velocidex Velociraptor has an authorization bypass vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2026-7573 · ADVISORY
• docs.velociraptor.app/announcements/advisories/cve-2026-7573 · WEB
• Velocidex/velociraptor · PACKAGE
• docs.velociraptor.app/announcements/advisories/cve-2026-7573 · Vendor Advisory
• GitHub Advisory GHSA-3c93-g9g6-p5j4 · ADVISORY

www.velocidex.com/golang/velociraptor のその他の脆弱性

• CVE-2026-6863中 6.8Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in…
• CVE-2026-7572中 5.5An off-by-one error (CWE-193) in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on …
• CVE-2026-6290緊急 9.1Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current …
• CVE-2025-6264中 5.5Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually…
• CVE-2023-0290中 4.3Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where t…