CVE-2025-6264

Name of the Vulnerable Software and Affected Versions Velociraptor (affected versions not specified)

Description The issue concerns the Velociraptor's artifact collection feature, which allows users to collect and execute VQL queries packaged into artifacts from endpoints. These artifacts typically run with elevated permissions. A specific artifact,

Admin.Client.UpdateClientConfig

, used for updating the client's configuration, did not enforce an additional required permission. As a result, users with

COLLECT CLIENT

permissions, usually granted by the "Investigator" role, could collect this artifact from endpoints and update the configuration. This can lead to arbitrary command execution and endpoint takeover. To exploit this issue, the user must already have access to collect artifacts from the endpoint, typically granted by the "Investigator" role.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.