CVE-2026-85737: Missing Authorization and Arbitrary File Disclosure in Velocidex Velociraptor sql() VQL Plugin

Vulnerability ID: CVE-2026-85737
CVSS Score: 6.5
Published: 2026-11-09

An authorization bypass vulnerability in Velocidex Velociraptor versions prior to 0.77.2 allows authenticated users with low-privilege query permissions to bypass access controls in the sql() VQL plugin. By supplying crafted MySQL connection strings pointing to an attacker-controlled rogue MySQL server with local-infile enabled, an attacker can read arbitrary files from the Velociraptor server host filesystem with the privileges of the server process.

TL;DR

Velociraptor prior to 0.77.2 fails to enforce FILESYSTEM_READ and NETWORK ACL checks in the sql() VQL plugin. Authenticated users holding ANY_QUERY permissions can initiate outbound connections to a rogue MySQL server and exploit the MySQL LOCAL INFILE protocol feature to exfiltrate arbitrary files from the Velociraptor server.

Technical Details

• Vulnerability Type: CWE-862: Missing Authorization
• Affected Component: vql/parsers/sql/sql.go (SQLPlugin.Call)
• Attack Vector: Network (Authenticated VQL Query with ANY_QUERY)
• CVSS v3.1 Score: 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
• EPSS Score: 0.24% (14.97th Percentile)
• Primary Impact: Arbitrary Server File Read via MySQL LOCAL INFILE
• Exploit Status: No known public exploits or active exploitation
• Patched Version: Velociraptor 0.77.2

Affected Systems

• Velocidex Velociraptor
• Velociraptor: < 0.77.2 (Fixed in: 0.77.2)

Code Analysis

Commit: d7de958

Enforce FILESYSTEM_READ and NETWORK ACL checks in SQLPlugin.Call and update SQLPlugin.Info metadata

diff --git a/vql/parsers/sql/sql.go b/vql/parsers/sql/sql.go
index c1eeb879549..5bfcc42ae1a 100644
--- a/vql/parsers/sql/sql.go
+++ b/vql/parsers/sql/sql.go
@@ -119,6 +119,11 @@ func (self SQLPlugin) Call(
            return

        case "sqlite":
+           err := vql_subsystem.CheckAccess(scope, acls.FILESYSTEM_READ)
+           if err != nil {
+               scope.Log("sql: %v", err)
+               return
+           }
            handle, err = GetHandleSqlite(ctx, arg, scope)
            if err == notValidDatabase {
                return
@@ -130,6 +135,15 @@ func (self SQLPlugin) Call(
            }

        case "mysql", "postgres":
+           err := vql_subsystem.CheckAccess(scope,
+               acls.FILESYSTEM_READ,
+               acls.NETWORK,
+           )
+           if err != nil {
+               scope.Log("sql: %v", err)
+               return
+           }
+
            handle, err = self.GetHandleOther(scope, arg.ConnString, arg.Driver)
            if err != nil {
                scope.Log("sql: %s", err)
@@ -213,10 +227,11 @@ func (self SQLPlugin) Call(

 func (self SQLPlugin) Info(scope vfilter.Scope, type_map *vfilter.TypeMap) *vfilter.PluginInfo {
    return &vfilter.PluginInfo{
-       Name:     "sql",
-       Doc:      "Run queries against sqlite, mysql, and postgres databases",
-       ArgType:  type_map.AddType(scope, &SQLPluginArgs{}),
-       Metadata: vql_subsystem.VQLMetadata().Permissions(acls.FILESYSTEM_READ).Build(),
+       Name:    "sql",
+       Doc:     "Run queries against sqlite, mysql, and postgres databases",
+       ArgType: type_map.AddType(scope, &SQLPluginArgs{}),
+       Metadata: vql_subsystem.VQLMetadata().Permissions(
+           acls.FILESYSTEM_READ, acls.NETWORK).Build(),
    }
 }

Commit: f25390f

Sync 0.77.2 release patch for sql() VQL plugin ACL checks

Mitigation Strategies

• Upgrade Velociraptor server installations to version 0.77.2 or later to enforce runtime ACL checks in the sql() VQL plugin.
• Disable the sql() VQL plugin globally via the security.denied_plugins directive in server.config.yaml if immediate patching is not possible.
• Implement strict outbound network egress filtering on the Velociraptor server host to block unauthorized outbound TCP connections (e.g., TCP ports 3306 and 5432).
• Run the Velociraptor server service under a dedicated low-privilege operating system account rather than root or SYSTEM.

Remediation Steps:

1. Download the official Velociraptor v0.77.2 release binary from https://github.com/Velocidex/velociraptor/releases/tag/v0.77.2.
2. Replace the existing Velociraptor server binary on the host system and restart the Velociraptor server service.
3. If applying the workaround instead of upgrading, edit server.config.yaml to include 'sql' under security.denied_plugins and restart the Velociraptor service.
4. Audit historical VQL query logs for prior executions of the sql() plugin utilizing the 'mysql' or 'postgres' drivers or containing the 'allowAllFiles' parameter.

References

• GitHub Security Advisory GHSA-9qq5-422f-33c2
• NVD Vulnerability Detail: CVE-2026-85737
• CVE.org Record: CVE-2026-85737
• Velociraptor Pull Request #4952 (Sync 0.77.2)
• Fix Commit d7de958e846d3742a7a3a8538fd463e4f12fc528
• Fix Commit f25390f8fbd00c888f0b7aaba2c061a51c3f7082
• Velociraptor Release v0.77.2
• CVEListV5 JSON Record for CVE-2026-85737
• CISA Known Exploited Vulnerabilities Catalog

Read the full report for CVE-2026-85737 on our website for more details including interactive diagrams and full exploit analysis.