—

GO-2026-5438

Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token in www.velocidex.com/golang/velociraptor

Details

Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token in www.velocidex.com/golang/velociraptor

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/www.velocidex.com/golang/velociraptor

Introduced in: 0

No fixed version published yet for www.velocidex.com/golang/velociraptor (go modules). Pin to a known-safe version or switch to an alternative.

References

https://github.com/advisories/GHSA-hv5g-26jg-pc45[ADVISORY]
https://nvd.nist.gov/vuln/detail/CVE-2026-6290[ADVISORY]
https://docs.velociraptor.app/announcements/advisories/cve-2026-6290[WEB]