CVE-2026-8795: Rapid7 Velociraptor YAML Injection in Remapping Artifact (v0.76.6)

Technical summary

CVE-2026-8795 is a YAML injection vulnerability in Velociraptor's Windows.Collectors.Remapping artifact. The vulnerability stems from unsafe template rendering: the hostname field from client_info.json is directly interpolated into a Go text/template YAML document without sanitization. An attacker can craft a hostname containing literal newlines and double-quote characters to escape the YAML quoted string context and inject arbitrary mount remapping directives. When an analyst applies the generated remapping configuration with the --remap flag, the injected VQL payload executes under NullACLManager permissions, which grants unrestricted access to filesystem and system operations without sandboxing constraints.

Business impact

Incident response and forensics teams using Velociraptor face operational risk during evidence triage. A compromised endpoint collection, either from an attacker-controlled machine or intercepted in transit, can weaponize the analysis workflow itself. An analyst reviewing what appears to be routine forensic artifacts inadvertently triggers code execution on their investigative workstation. This compromises the integrity of the investigation, risks lateral movement into the incident response infrastructure, and potentially exposes access credentials or other sensitive investigative data. For organizations relying on Velociraptor for rapid incident response, this creates a vector where the response process becomes an attack surface.

Affected systems

Rapid7 Velociraptor versions prior to 0.76.6 are affected. The vulnerability is specific to Windows artifact collection processing and remapping workflows, though the underlying template injection is in the core artifact engine. The risk is highest in environments where analysts process collections from untrusted endpoints or where collections transit insecure channels before local analysis.

Exploitability

Exploitation requires two preconditions: (1) an attacker must supply a malicious collection ZIP, typically by compromising an endpoint or intercepting network transmission, and (2) an analyst must actively invoke the --remap flag during local analysis. The technical barrier is low—crafting a hostname with YAML injection payloads is straightforward—but the social/operational barrier is non-trivial because the analyst must consciously choose to apply remapping. No authentication bypass or network interaction is required once the ZIP is obtained. This is classified as a local attack vector with user interaction required (CVSS AV:L/UI:R), but the impact is severe because execution happens outside sandboxing.

Remediation

Upgrade Rapid7 Velociraptor to version 0.76.6 or later. The patched version implements proper escaping or safe templating for hostname and other user-controlled fields before YAML generation. Organizations unable to patch immediately should restrict --remap usage to collections sourced from trusted, air-gapped systems and educate analysts on risks of processing evidence from potentially compromised endpoints without additional validation.

Patch guidance

Apply Rapid7 Velociraptor version 0.76.6 or later as soon as feasible. Verify the patch availability through the official Rapid7 release channels or your software distribution process. If operating an enterprise Velociraptor deployment, prioritize updates to analyst workstations and central server instances. No interim mitigations substitute for patching; the vulnerability is inherent to the artifact template engine in affected versions.

Detection guidance

Monitor for suspicious VQL execution on analyst workstations, particularly commands executed with elevated permissions or those accessing filesystem recursively (common in post-exploitation). Examine client_info.json files within collection ZIPs for hostname fields containing escaped quotes, newlines, or YAML syntax characters—these are red flags for injection attempts. Audit logs from Velociraptor collectors should be reviewed for unexpected collection metadata or hostname anomalies. Consider restricting --remap usage to a controlled environment pending patching.

Why prioritize this

This vulnerability merits immediate attention despite moderate attack complexity because it inverts the trust model of forensic analysis—the response activity itself becomes a compromise vector. The CVSS 7.8 HIGH score reflects severe impact (code execution, full confidentiality/integrity/availability compromise) combined with local-only distribution. Organizations with active incident response programs should deprioritize based on the constraint that the attacker must successfully deliver a collection, but should not delay patching beyond the next maintenance window.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector Local—the malicious collection must reach the analyst's workstation; Attack Complexity Low—YAML injection is trivial to craft; Privileges Required None—no prior access needed once the ZIP is obtained; User Interaction Required—analyst must actively use --remap; Scope Unchanged—impact is confined to the analyst's machine; Confidentiality/Integrity/Availability all High—arbitrary code execution with full permissions. The score appropriately elevates this beyond a typical template injection because the execution context (NullACLManager, unsandboxed) eliminates compensating controls.

Frequently asked questions