CVE-2026-64954

Description

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run arbitrary VQL (usually with the -analyst- role) to launch new collections (usually requires the -investigator- role). This vulnerability is an escalation from an analyst to investigator role.