Vulnerability in Rapid7 Velociraptor

[ Description ]Official description

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server admin.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund4 Oct 2026WID-SEC-2026-3731

  Rapid7 Velociraptor: Multiple vulnerabilities Translated from German

  CVE-2026-78413CVE-2026-78412CVE-2026-78411

[ References ]References

• docs.velociraptor.app/announcements/advisories/cve-2026-78411