Rapid7 Velociraptor versions prior to 0

CVE-2026-5329 is a server-side input-validation bug in Rapid7 Velociraptor's client monitoring message handler. On vulnerable self-hosted Linux servers, a *rogue client* can send a crafted monitoring message with a malicious queue name and write into privileged internal server queues, which the vendor says may lead to remote code execution. The vendor advisory originally described versions prior to 0.76.2, but both the vendor advisory note and NVD change history show the practical fixed lines are 0.75.7 and 0.76.3, because 0.76.2 had a patch shortcoming for master/minion deployments.

Vendor *impact* is fair, but vendor *urgency* is a little overstated for enterprise patch triage. This is not an unauthenticated internet wormhole; it requires the attacker to already control or impersonate a Velociraptor client, which is a major real-world friction point. That said, once that prerequisite is met, the blast radius is ugly because this is the management plane for endpoint telemetry and response, so I keep it in HIGH rather than dropping it to MEDIUM.

Why this verdict

• Downgrade for attacker position: vendor's PR:L hides the real meaning here — the attacker typically needs a compromised enrolled endpoint or stolen client config, so this is usually *post-initial-access* rather than true edge exploitation.
• Downgrade for exposed population: only self-hosted Linux Velociraptor servers are in scope, and Rapid7 Hosted Velociraptor is explicitly unaffected. That sharply narrows the reachable enterprise population.
• Not lower because blast radius is ugly: if a rogue client can turn queue injection into server compromise, the target is a security management plane with visibility and control over many endpoints.

Why not higher?

This is not unauthenticated remote exploitation against a broadly exposed web edge. The chain depends on prior attacker position as a client, protocol-aware crafting, and a downstream path from queue write to meaningful server compromise; those are all strong downward pressures. No KEV listing, low EPSS, and no reviewed public PoC also keep it out of CRITICAL.

Why not lower?

A compromise of the Velociraptor server is not a routine local-only nuisance; it is a control-plane event with potentially fleet-wide consequences. In large enterprises, assuming the attacker may already own *some* managed endpoint is realistic, so the rogue-client prerequisite is meaningful friction but not a fantasy blocker.

1. Constrain frontend reachability — Restrict the client/frontend listener to known endpoint ranges, VPN egress, or managed network paths instead of broad internet exposure. For a HIGH verdict, deploy this compensating control within 30 days if patching is not already complete.
2. Require client certificates — Enable Velociraptor Frontend.require_client_certificates to force mTLS on the frontend and raise the bar for arbitrary internet-originating traffic. This does not stop a truly compromised enrolled client, but it does cut off opportunistic external probing and should be rolled out within 30 days.
3. Harden and monitor the Linux server — Put EDR/audit coverage on the Velociraptor server itself and alert on unexpected child processes, shells, interpreters, or changes under the service account. Treat this as a 30-day control because the server is the high-value blast-radius point.
4. Review client trust material handling — Audit how client configs, certificates, and repackaged installers are stored and distributed so attackers cannot easily reuse them from a compromised endpoint or admin share. Tighten this within 30 days because stolen client material is the most realistic bridge into this flaw.

Run this on the target Velociraptor Linux server or through SSH with a read-only shell account that can execute the velociraptor binary or query the local package manager. Save as check-cve-2026-5329.sh and run bash check-cve-2026-5329.sh or bash check-cve-2026-5329.sh /usr/local/bin/velociraptor; no root is required unless your package metadata is restricted.

#!/usr/bin/env bash
# Check CVE-2026-5329 exposure on a Linux Velociraptor server.
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET_BIN="${1:-}"

fail_unknown() {
  echo "UNKNOWN"
  exit 2
}

is_linux() {
  [ "$(uname -s 2>/dev/null)" = "Linux" ]
}

version_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

version_gt() {
  # returns 0 if $1 > $2
  [ "$1" != "$2" ] && version_ge "$1" "$2"
}

version_lt() {
  # returns 0 if $1 < $2
  ! version_ge "$1" "$2"
}

extract_semver() {
  echo "$1" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1
}

get_version_from_binary() {
  local bin="$1"
  [ -x "$bin" ] || return 1
  local out
  out="$($bin version 2>/dev/null || $bin --version 2>/dev/null || true)"
  extract_semver "$out"
}

get_version_from_pkg() {
  local out=""
  if command -v dpkg-query >/dev/null 2>&1; then
    out="$(dpkg-query -W -f='${Version}\n' velociraptor 2>/dev/null || true)"
    extract_semver "$out" && return 0
  fi
  if command -v rpm >/dev/null 2>&1; then
    out="$(rpm -q velociraptor 2>/dev/null || true)"
    extract_semver "$out" && return 0
  fi
  return 1
}

classify_version() {
  local ver="$1"

  # Branch-aware handling based on vendor/NVD guidance:
  # - 0.74.x fixed at 0.74.7 (release note)
  # - 0.75.x fixed at 0.75.7
  # - 0.76.x fixed effectively at 0.76.3 because 0.76.2 had a patch shortcoming on master/minion

  case "$ver" in
    0.76.2)
      echo "UNKNOWN"
      exit 2
      ;;
    0.76.*)
      if version_lt "$ver" "0.76.3"; then
        echo "VULNERABLE"
        exit 1
      else
        echo "PATCHED"
        exit 0
      fi
      ;;
    0.75.*)
      if version_lt "$ver" "0.75.7"; then
        echo "VULNERABLE"
        exit 1
      else
        echo "PATCHED"
        exit 0
      fi
      ;;
    0.74.*)
      if version_lt "$ver" "0.74.7"; then
        echo "VULNERABLE"
        exit 1
      else
        echo "PATCHED"
        exit 0
      fi
      ;;
    *)
      # Older/other branches are not clearly documented in reviewed sources.
      echo "UNKNOWN"
      exit 2
      ;;
  esac
}

main() {
  is_linux || fail_unknown

  local ver=""
  if [ -n "$TARGET_BIN" ]; then
    ver="$(get_version_from_binary "$TARGET_BIN")"
  fi

  if [ -z "$ver" ] && command -v velociraptor >/dev/null 2>&1; then
    ver="$(get_version_from_binary "$(command -v velociraptor)")"
  fi

  if [ -z "$ver" ]; then
    ver="$(get_version_from_pkg || true)"
  fi

  [ -n "$ver" ] || fail_unknown
  classify_version "$ver"
}

main "$@"

Sources

1. Velociraptor vendor advisory for CVE-2026-5329
2. NVD record for CVE-2026-5329
3. Velociraptor GitHub releases
4. Velociraptor quickstart deployment guide
5. Velociraptor security configuration guide
6. CISA Known Exploited Vulnerabilities catalog
7. FIRST EPSS API documentation
8. Triskele Labs summary of CVE-2026-5329