CVE-2026-85737 · Other
NO FIX YET · SEE WHAT TO DO
The SQL plugin in Velociraptor opens outbound database connections without the file-read and network permission checks. A rogue MySQL server can make the Velociraptor server read files it can access, including root-readable files when it runs as root.
first public Aug 25, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any Velociraptor server before 0.77.2 is exposed. An attacker needs a low-privilege analyst account with ANY_QUERY permission, or another way to run VQL queries, and MySQL local-infile is what enables the file read. Deployments where only fully trusted administrators can run queries are at lower risk, but the sources do not say how much that reduces exposure.
Not affected if no-untrusted-query-users, upgraded-to-0.77.2
Who cares dfir, self-hosted, velociraptor
0.77.2.ANY_QUERY permission.0.77.2 or later.Velociraptor is a tool for collecting host-based state information using Velociraptor Query Language (VQL) queries. Prior to 0.77.2, SQLPlugin.Call in vql/parsers/sql/sql.go does not enforce plugin-level FILESYSTEM_READ or NETWORK checks before the mysql and postgres branches pass a caller-controlled connstring to sql.Open, allowing arbitrary outbound database connections. With attacker-controlled MySQL connection options that enable local-infile access, a rogue MySQL server can request files readable by the Velociraptor server process, including root-readable files when that process runs as root. The SQLite file accessor still enforces FILESYSTEM_READ, but a low-privilege analyst with ANY_QUERY can use the zero-permission data accessor and ATTACH DATABASE to create files without the plugin-level check. This issue is fixed in version 0.77.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.