CVE-2026-19584

7.7 highEPSS 0.3%

High (7.7). EPSS 0.3% chance of exploitation in the next 30 days.

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query which will be evaluated at elevated permissions if the notebook's backup is subsequently restored.

Severity

CVSS 3.1

7.7 high

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWEs: CWE-94, CWE-1336
Published: 2026-09-10
Modified: 2026-09-11
Record from: the NVD, synced 2026-10-19

References

http://docs.velociraptor.app/announcements/advisories/cve-2026-19584/
https://github.com/Velocidex/velociraptor/pull/4967

Check your stack JSON