{"id":"CVE-2026-85737","kind":"vulnerability","aliases":["CVE-2026-85737"],"related":[],"title":"Velociraptor: flawed SQL plugin lets queries read server files","description":"Velociraptor is a tool for collecting host-based state information using Velociraptor Query Language (VQL) queries. Prior to 0.77.2, SQLPlugin.Call in vql/parsers/sql/sql.go does not enforce plugin-level FILESYSTEM_READ or NETWORK checks before the mysql and postgres branches pass a caller-controlled connstring to sql.Open, allowing arbitrary outbound database connections. With attacker-controlled MySQL connection options that enable local-infile access, a rogue MySQL server can request files readable by the Velociraptor server process, including root-readable files when that process runs as root. The SQLite file accessor still enforces FILESYSTEM_READ, but a low-privilege analyst with ANY_QUERY can use the zero-permission data accessor and ATTACH DATABASE to create files without the plugin-level check. This issue is fixed in version 0.77.2.","summary":"The SQL plugin in Velociraptor opens outbound database connections without the file-read and network permission checks. A rogue MySQL server can make the Velociraptor server read files it can access, including root-readable files when it runs as root.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dfir","other","self-hosted","velociraptor"],"not_affected_if":["no-untrusted-query-users","upgraded-to-0.77.2"],"how_to_check":"- Check whether the Velociraptor server version is below `0.77.2`.\n- Check whether the server process runs as root.\n- Check which users hold `ANY_QUERY` permission.","fix":"- Velociraptor: move to `0.77.2` or later.","status":"open","published_at":"2026-11-06T21:17:11+00:00","first_seen_at":"2026-11-06T21:45:08+00:00","triaged_at":"2026-11-06T21:46:47+00:00","updated_at":"2026-11-06T21:46:47+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-06T21:46:47Z","model":"claude-haiku-5-5","output":{"fix":"- Velociraptor: move to `0.77.2` or later.","reach":"network","title":"Velociraptor: flawed SQL plugin lets queries read server files","impact":"high","summary":"The SQL plugin in Velociraptor opens outbound database connections without the file-read and network permission checks. A rogue MySQL server can make the Velociraptor server read files it can access, including root-readable files when it runs as root.","audience":"businesses","category":"other","nicknames":[],"who_cares":["velociraptor","self-hosted","dfir"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Server process reads root-only files and creates files on the server","analyst_note":"","how_to_check":"- Check whether the Velociraptor server version is below `0.77.2`.\n- Check whether the server process runs as root.\n- Check which users hold `ANY_QUERY` permission.","plain_action":"","needs_analyst":false,"not_affected_if":["upgraded-to-0.77.2","no-untrusted-query-users"],"who_is_affected":"Any Velociraptor server before `0.77.2` is exposed. An attacker needs a low-privilege analyst account with `ANY_QUERY` permission, or another way to run VQL queries, and MySQL local-infile is what enables the file read. Deployments where only fully trusted administrators can run queries are at lower risk, but the sources do not say how much that reduces exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001112,"input_tokens":4486,"output_tokens":1327,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-85737':12A,15A '0.77.2':83C,197C 'access':53B,129C 'accessor':157C,178C 'allow':112C 'analyst':167C 'arbitrari':113C 'attach':180C 'attack':119C 'attacker-control':118C 'base':72C 'branch':103C 'caller':107C 'caller-control':106C 'check':39B,97C,190C 'collect':69C 'connect':30B,116C,122C 'connstr':109C 'control':108C,120C 'creat':183C 'cve':10A,13A 'data':177C 'databas':29B,115C,181C 'dfir':16B 'enabl':125C 'enforc':89C,159C 'file':9A,34B,50B,58B,136C,147C,156C,184C 'file-read':33B 'filesystem':93C,160C 'fix':194C 'flaw':2A 'host':20B,71C 'host-bas':70C 'includ':54B,143C 'infil':128C 'inform':74C 'issu':192C 'languag':78C 'let':5A 'level':92C,189C 'local':127C 'local-infil':126C 'low':165C 'low-privileg':164C 'make':45B 'mysql':42B,100C,121C,132C 'network':37B,96C 'open':27B 'option':123C 'outbound':28B,114C 'pass':104C 'permiss':38B,176C 'plugin':4A,24B,91C,188C 'plugin-level':90C,187C 'postgr':102C 'prior':81C 'privileg':166C 'process':142C,150C 'queri':6A,77C,80C,170C 'read':7A,35B,49B,94C,161C 'readabl':57B,137C,146C 'request':135C 'rogu':41B,131C 'root':56B,63B,145C,153C 'root-read':55B,144C 'run':61B,151C 'self':19B 'self-host':18B 'server':8A,43B,48B,133C,141C 'sql':3A,23B 'sql.open':111C 'sqlite':155C 'sqlplugin.call':84C 'state':73C 'still':158C 'tool':67C 'use':75C,172C 'velociraptor':1A,21B,26B,47B,64C,76C,140C 'version':196C 'vql':79C 'vql/parsers/sql/sql.go':86C 'without':31B,185C 'zero':175C 'zero-permiss':174C","nicknames":[],"mitigations":[],"who_affected":"Any Velociraptor server before `0.77.2` is exposed. An attacker needs a low-privilege analyst account with `ANY_QUERY` permission, or another way to run VQL queries, and MySQL local-infile is what enables the file read. Deployments where only fully trusted administrators can run queries are at lower risk, but the sources do not say how much that reduces exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dfir","medium","other","selfhosted","velociraptor"],"campaign_type":null,"search_a":"'-2026':11A,14A '-85737':12A,15A 'cve':10A,13A 'file':9A 'flaw':2A 'let':5A 'plugin':4A 'queri':6A 'read':7A 'server':8A 'sql':3A 'velociraptor':1A","search_b":"'access':53B 'check':39B 'connect':30B 'databas':29B 'dfir':16B 'file':34B,50B,58B 'file-read':33B 'host':20B 'includ':54B 'make':45B 'mysql':42B 'network':37B 'open':27B 'outbound':28B 'permiss':38B 'plugin':24B 'read':35B,49B 'readabl':57B 'rogu':41B 'root':56B,63B 'root-read':55B 'run':61B 'self':19B 'self-host':18B 'server':43B,48B 'sql':23B 'velociraptor':21B,26B,47B 'without':31B","search_c":"'0.77.2':83C,197C 'access':129C 'accessor':157C,178C 'allow':112C 'analyst':167C 'arbitrari':113C 'attach':180C 'attack':119C 'attacker-control':118C 'base':72C 'branch':103C 'caller':107C 'caller-control':106C 'check':97C,190C 'collect':69C 'connect':116C,122C 'connstr':109C 'control':108C,120C 'creat':183C 'data':177C 'databas':115C,181C 'enabl':125C 'enforc':89C,159C 'file':136C,147C,156C,184C 'filesystem':93C,160C 'fix':194C 'host':71C 'host-bas':70C 'includ':143C 'infil':128C 'inform':74C 'issu':192C 'languag':78C 'level':92C,189C 'local':127C 'local-infil':126C 'low':165C 'low-privileg':164C 'mysql':100C,121C,132C 'network':96C 'option':123C 'outbound':114C 'pass':104C 'permiss':176C 'plugin':91C,188C 'plugin-level':90C,187C 'postgr':102C 'prior':81C 'privileg':166C 'process':142C,150C 'queri':77C,80C,170C 'read':94C,161C 'readabl':137C,146C 'request':135C 'rogu':131C 'root':145C,153C 'root-read':144C 'run':151C 'server':133C,141C 'sql.open':111C 'sqlite':155C 'sqlplugin.call':84C 'state':73C 'still':158C 'tool':67C 'use':75C,172C 'velociraptor':64C,76C,140C 'version':196C 'vql':79C 'vql/parsers/sql/sql.go':86C 'without':185C 'zero':175C 'zero-permiss':174C","first_public_at":"2026-08-25T05:07:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85737","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85737","severity":null,"published_at":"2026-11-06T21:17:11+00:00","modified_at":"2026-11-06T21:17:11+00:00","first_seen_at":"2026-11-06T21:45:08+00:00","fetched_at":"2026-11-06T21:45:08+00:00","note":null}],"documents":[{"id":90358,"url":"https://github.com/Velocidex/velociraptor/commit/d7de958e846d3742a7a3a8538fd463e4f12fc528","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90359,"url":"https://github.com/Velocidex/velociraptor/commit/f25390f8fbd00c888f0b7aaba2c061a51c3f7082","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90360,"url":"https://github.com/Velocidex/velociraptor/releases/tag/v0.77.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90361,"url":"https://github.com/Velocidex/velociraptor/security/advisories/GHSA-9qq5-422f-33c2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-25T05:07:01+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}