CVE-2026-5329

{
  "id": "CVE-2026-5329",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-09T18:17:04.253",
  "lastModified": "2026-10-26T00:10:00.150",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring message handler on the Velociraptor server (primarily Linux) that allows an authenticated remote attacker  to write to arbitrary internal server queues via a crafted monitoring message with a malicious queue name. The server handler that receives client monitoring messages does not sufficiently validate the queue name supplied by the client, allowing a rogue client to write arbitrary messages to privileged internal queues. This may lead to remote code execution on the Velociraptor server. Rapid7 Hosted Velociraptor instances are not affected by this vulnerability."
    },
    {
      "lang": "es",
      "value": "Las versiones de Rapid7 Velociraptor anteriores a la 0.76.2 contienen una vulnerabilidad de validación de entrada inadecuada en el gestor de mensajes de monitorización del cliente en el servidor de Velociraptor (principalmente Linux) que permite a un atacante remoto autenticado escribir en colas internas arbitrarias del servidor a través de un mensaje de monitorización manipulado con un nombre de cola malicioso. El gestor del servidor que recibe los mensajes de monitorización del cliente no valida suficientemente el nombre de la cola proporcionado por el cliente, permitiendo que un cliente malicioso escriba mensajes arbitrarios en colas internas privilegiadas. Esto puede conducir a la ejecución remota de código en el servidor de Velociraptor. Las instancias de Rapid7 Hosted Velociraptor no se ven afectadas por esta vulnerabilidad."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Rapid7",
          "product": "Velociraptor",
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "repo": "https://github.com/Velocidex/velociraptor",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "0.76.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThanOrEqual": "0.75.6",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThanOrEqual": "0.74.6",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 6.0
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-09T00:00:00+00:00",
          "id": "CVE-2026-5329",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    },
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "0.75.6",
              "matchCriteriaId": "BAC49A9C-FD09-45D6-9493-5DA3AFF9E3AD"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "0.76",
              "versionEndExcluding": "0.76.3",
              "matchCriteriaId": "35A554F9-5926-43C1-B906-BDB41CB36CB3"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-5329/",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}