Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and update the configuration. This can lead to arbitrary command execution and endpoint takeover. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator' role).

The version of Rapid7 Velociraptor installed on the remote host is prior to 0.74.3. It is, therefore, affected by privilege escalation vulnerability:

  - Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can     be used to do anything and usually run with elevated permissions.  To limit access to some dangerous     artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The     Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact     did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions     (normally given by the 'Investigator' role) to collect it from endpoints and update the configuration.     This can lead to arbitrary command execution and endpoint takeover. To successfully exploit this     vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the     COLLECT_CLIENT given typically by the 'Investigator' role). (CVE-2025-6264)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can
    be used to do anything and usually run with elevated permissions. To limit access to some dangerous
    artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The
    Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact
    did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions
    (normally given by the "Investigator" role) to collect it from endpoints and update the configuration.
    This can lead to arbitrary command execution and endpoint takeover. To successfully exploit this
    vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the
    COLLECT_CLIENT given typically by the "Investigator' role). (CVE-2025-6264)

ID	Name	Product	Family	Type	Severity
279071	Rapid7 Velociraptor < 0.74.3 Privilege Escalation	Nessus	Misc.	Local	medium
435601	SCA: security update for www.velocidex.com/golang/velociraptor (GHSA-gpfc-mph4-qm24)	Tenable Cloud Security	SCA Checks	Local	medium
435601	SCA: security update for www.velocidex.com/golang/velociraptor (GHSA-gpfc-mph4-qm24)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2025-6264

medium

Tenable Plugins

medium

medium

medium