CVE-2026-64952

The CVSS 6.5 score for CVE-2026-64952 badly understates the real risk. This is a privilege boundary violation that lets any account with COLLECT_CLIENT permission delete hunts—objects that in Velociraptor are not administrative tasks but investigative records containing the complete forensic record of what was investigated, when, and against which endpoints. The vulnerability doesn't require a zero-day; it requires a valid investigator credential, which organizations frequently grant to third-party DFIR consultants, managed security providers, and internal red teamers. The critical distinction: most privilege escalations give attackers forward-looking capabilities. This one is backward-looking. A compromised or malicious investigator can destroy evidence of their own activity—or activity directed at them—after the fact. That changes the remediation calculus entirely. Patching the permission check prevents future abuse but cannot restore hunts already deleted during the vulnerable window. Your response to this CVE must extend beyond applying the patch. First, treat this as a trigger for historical log review: if any investigator-level account was compromised before patching, the question isn't just 'can they delete hunts now'—it's 'did they delete hunts already?' Second, audit your investigator account inventory now. These credentials accumulate over time—consultants who finished engagements, employees who rotated roles, emergency accounts provisioned during incidents and never revoked. The 'sediment layer' of stale investigator access is where this vulnerability becomes exploitable in practice. Third, verify whether the patch includes audit trail enforcement for hunt deletions and whether administrators receive notifications when hunts disappear. A permission check alone leaves you blind to abuse. Finally, recognize that this vulnerability fits a pattern across DFIR tooling—EnCase, BlackLight, Cellebrite, and now Velociraptor have all exhibited functionally identical permission boundary errors where forensic operators could delete records that should require elevated roles. The pattern suggests that a permission check fix alone is necessary but insufficient; the underlying assumption that investigative records are disposable admin objects will surface again in different functions unless the platform's design philosophy changes. Your vendor engagement should press for immutable audit objects with independent retention safeguards, not just the immediate permission fix.

Reviewed through automated stages and approved by a human before publication.