CVE-2026-19200

This vulnerability exposes a design flaw that goes well beyond a simple permission misconfiguration. The verify() function—a read-only validation operation by its very name—was able to write to the global artifact repository because the API makes the global store the path of least resistance while requiring explicit effort for isolated, ephemeral contexts. An analyst with NOTEBOOK_EDIT can overwrite existing artifacts, fundamentally altering what data Velociraptor collects and how it processes results. The attack surface is substantial: overwriting a collection artifact changes forensic behavior for every subsequent hunt that references it, without requiring the technical sophistication needed to create a new artifact from scratch. The critical question is not just whether this specific bug is patched, but whether Velociraptor's VQL architecture has other functions carrying the same implicit assumption—that global state is acceptable because the function's name suggests safety. Verify operations specifically occupy a dangerous space in developer mental models: they signal inspection, not action, so they escape the security scrutiny that write operations receive. The permission model and the function API evolved on parallel tracks and never got formally reconciled. Defenders should verify that audit logging captures artifact overwrites with sufficient fidelity—if overwrites are silent in typical deployments, exploitation could persist indefinitely. Review other VQL functions with names implying read-only behavior (get, query, list, export) for similar side effects. The fix should enforce repository isolation at the function level rather than relying on callers to explicitly provide a non-global context—if it doesn't, expect similar vulnerabilities to surface in other functions as developers migrate existing notebook code.

Reviewed through automated stages and approved by a human before publication.