GHSA-hv5g-26jg-pc45

Source

https://github.com/advisories/GHSA-hv5g-26jg-pc45

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-hv5g-26jg-pc45/GHSA-hv5g-26jg-pc45.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hv5g-26jg-pc45

Aliases

CVE-2026-6290
GO-2026-5438

Published

2026-04-15T18:31:58Z

Modified

2026-06-25T23:11:23Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token

Details

Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are the same as the permissions they have in the org containing the notebook.

Database specific

{
    "cwe_ids": [
        "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-16T21:33:30Z",
    "nvd_published_at": "2026-04-15T18:17:25Z",
    "severity": "CRITICAL"
}

References

Affected packages

Go / www.velocidex.com/golang/velociraptor

Package

Name: www.velocidex.com/golang/velociraptor; View open source insights on deps.dev
Purl: pkg:golang/www.velocidex.com/golang/velociraptor

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

0.76.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-hv5g-26jg-pc45/GHSA-hv5g-26jg-pc45.json"