PT-2026-31678 · Rapid7 · Velociraptor

Chris Au + 1 · CVE-2026-5329 · Published 2026-04-09 · Updated 2026-04-28

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rapid7 Velociraptor versions prior to 0.76.2

Description Rapid7 Velociraptor versions before 0.76.2 have an input validation issue in the client monitoring message handler on the Velociraptor server (primarily Linux). An authenticated remote attacker can write to arbitrary internal server queues by sending a crafted monitoring message with a malicious queue name. The server handler does not properly validate the queue name provided by the client, allowing a malicious client to write messages to privileged internal queues. This could lead to remote code execution on the Velociraptor server. Rapid7 Hosted Velociraptor instances are not affected.

Recommendations Update to version 0.76.2 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-5329

Affected Products

Velociraptor

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5329.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5329 · Security Note
• https://docs.velociraptor.app/announcements/advisories/cve-2026-5329 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-5329 · Vendor Advisory
• https://github.com/Velocidex/velociraptor · Note
• https://t.me/cveNotify/161174 · Telegram Post
• https://twitter.com/CveFindCom/status/2042312499974820346 · Twitter Post