CVE-2026-64952
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The hunt_delete() VQL function in Velociraptor allows deleting hunts. Velociraptor misapplied the permission check, requiring only COLLECT_CLIENT (usually assigned to the 'investigator' role) instead of the DELETE_RESULTS permission (usually only assigned to administrators).
Risk Assessment
Users with lower privileges can delete hunts, potentially leading to loss of forensic data and compromising the integrity of investigation processes.
Recommendation
Update Velociraptor to a version where the permission check is fixed, or manually configure permissions to require DELETE_RESULTS for hunt deletion operations.
Original NVD description (English source)
The hunt_delete() VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "investigator" role) instead of the "DELETE_RESULTS" permission (usually only assigned to "administrators").