CVE-2026-85737 | Velocidex Velociraptor up to 0.77.1 SQL Plugin vql/parsers/sql/sql.go SQLPlugin.Call connstring permission

November 6, 2026 Yanac

A vulnerability was found in Velocidex Velociraptor up to 0.77.1. It has been classified as problematic. Impacted is the function SQLPlugin.Call of the file vql/parsers/sql/sql.go of the component SQL Plugin. Performing a manipulation of the argument connstring results in permission issues.

This vulnerability is cataloged as CVE-2026-85737. It is possible to initiate the attack remotely. There is no exploit available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More