Velociraptor Vulnerability Exposes Multi-Org Data
A significant vulnerability, tracked as CVE-2026-6290, has been identified in Velociraptor versions prior to 0.76.3. According to the National Vulnerability Database, this flaw resides within the query() plugin, allowing an authenticated GUI user to bypass intended organizational access controls.
Specifically, a user with legitimate access to one organization can leverage the query() plugin in a notebook cell to execute VQL queries against other organizations to which they do not explicitly have permission. The National Vulnerability Database reports that the user’s permissions in these unauthorized organizations mirror their permissions in the initial, legitimate organization. This is a classic case of improper access control, leading to a high-severity CVSS score of 8.0.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 auto-generated detection rules for this incident, mapped to MITRE ATT&CK. Available in Sigma, Splunk SPL, Sentinel KQL, Elastic Lucene, QRadar AQL, and Wazuh.
Credential Abuse from Breached Vendor — CVE-2026-6290
Want this in your SIEM's native format? Get Splunk SPL, Sentinel KQL, Elastic, QRadar AQL, or Wazuh — ready to paste.
3 Sigma rules mapped to the ATT&CK techniques from this breach — pick your SIEM and get a ready-to-paste query.
Get All SIEM Formats →Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-6290 | Privilege Escalation | Velociraptor versions prior to 0.76.3 |
| CVE-2026-6290 | Privilege Escalation | Vulnerable component: query() plugin |
| CVE-2026-6290 | Privilege Escalation | Attack vector: authenticated GUI user using query() plugin in a notebook cell to run VQL queries on other orgs |
Related Posts
Chrome V8 Type Confusion: Remote OOB Access Risk
CVE-2026-6363 — Type Confusion in V8 in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory access via...
Chrome 'Use-After-Free' Bug: High Severity RCE Risk
CVE-2026-6360 — Use after free in FileSystem in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially exploit object corruption via a crafted...
Chrome Video Bug: Renderer Compromise Leads to High-Severity RCE
CVE-2026-6359 — Use after free in Video in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process...