A critical authorization bypass in Rapid7 Velociraptor allows authenticated users to execute arbitrary commands on endpoints, posing a severe risk of unauthorized system control.

This vulnerability involves an incorrect permission assignment for critical resources, where the application fails to validate the required EXECVE permission or CLIENT_EVENTS type for client monitoring artifacts. Any authenticated user with the ability to schedule client monitoring artifacts can leverage this flaw to execute restricted artifacts, such as Linux.Sys.BashShell, resulting in arbitrary command execution on target endpoints.

The ability for an authenticated user to perform unauthorized command execution on monitored endpoints represents a critical security failure. This vulnerability could lead to total system compromise, exfiltration of sensitive data, or the deployment of malicious payloads across the enterprise environment. Given the high CVSS score of 9.9, this issue must be addressed with the highest priority to prevent potential lateral movement and full host takeover.

Immediate Action: Upgrade all instances of Rapid7 Velociraptor to version 0.77.2 or later to ensure proper permission gating is enforced.

Proactive Monitoring: Review access logs for unusual scheduling activities related to client monitoring artifacts and monitor endpoint behavior for unauthorized execution of system-level commands.

Compensating Controls: Restrict administrative and scheduling access to the Velociraptor console to a strictly limited set of trusted users until the patch can be deployed.

Public Exploit Available: No — there is no confirmed public exploit available.

The severity of this vulnerability necessitates an immediate response. Organizations should prioritize updating to version 0.77.2 across all deployments to rectify the underlying authorization logic failure. Failure to patch this flaw leaves the entire managed endpoint fleet exposed to potential full system compromise by any user with standard scheduling access.