Incorrect authorization in Velociraptor server metadata
Velociraptor’s SetClientMetadata API enforces the wrong permission when metadata is written on the server. A user who already has the LABEL_CLIENTS permission can change server metadata over the network without further interaction. That metadata commonly holds site-wide configuration that only a server administrator should be able to update, so the impact is unauthorized integrity changes to central configuration (CVSS 3.1 base score 6.5; CWE-863), not confidentiality or availability loss. Rapid7 Velociraptor deployments that grant LABEL_CLIENTS to non-admins are affected; affected version ranges are not stated in the supplied data. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Apply the fix from Rapid7 advisory AV26-1004 as soon as a patched Velociraptor build is available for your deployment. Until then, limit who holds LABEL_CLIENTS, and review server metadata for unexpected site-wide configuration changes by non-admin users.
| Rapid7 Velociraptor | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server admin.
Canada's Cyber Centre warns Rapid7 Velociraptor before 0.77.3 has insufficient permission checks (CVE-2026-78411).
On October 6, 2026, the Canadian Centre for Cyber Security issued advisory AV26-1004 for Rapid7 Velociraptor. Versions before 0.77.3 are affected by CVE-2026-78411, a server metadata update with an insufficient permission check. The centre urges administrators to review Rapid7's advisory and apply updates. No active exploitation is mentioned.