Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-78411 EUVD-2026-92523GHSA-gpw6-25f6-673m

Velociraptor Server Metadata update with Insufficient Permission Check

Published Oct 5, 2026 · Updated Oct 5, 2026 · Assigned by rapid7

Description

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata.

Server metadata is often used to store site wide configuration data that should only be updated by the server admin.

Affected products

VendorProductAffectedFixed
Rapid7 Velociraptor < 0.77.3 0.77.3

Advisories 1

References