CVE-2026-6290

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are the same as the permissions they have in the org containing the notebook.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Apr 15, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-629005.9Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a CVE-2026-629017.5Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-629026.5Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.CVE-2026-629045.4Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.CVE-2026-629067.4Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose in CVE-2026-629087.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized at CVE-2026-629097.8Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.CVE-2026-62916.5Bleichenbacher padding oracle in PKCS#7 KTRI decryption. When decrypting PKCS#7 EnvelopedData using RSA PKCS#1 v1.5 key transport, wolfSSL r CVE-2026-629108.8Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privil CVE-2026-629118.0Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-629126.5Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.CVE-2026-629138.8Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.