WID-SEC-W-2026-2728 - Vulnerability-Lookup

WID-SEC-W-2026-2728

Vulnerability from csaf_certbund - Published: 2026-08-10 22:00 - Updated: 2026-08-10 22:00

Summary

Rapid7 Velociraptor: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Rapid7 Velociraptor ist ein Tool zur Endpunkt-Erkennung und -Reaktion (EDR) und zur digitalen Forensik, das eine leistungsstarke Sammlung von Tools zur Überwachung und Analyse von Endpunkten bietet.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Rapid7 Velociraptor ausnutzen, um erweiterte Berechtigungen, einschließlich Administratorrechte, zu erlangen, Sicherheitsmaßnahmen zu umgehen, Spoofing- und Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, sensible Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Betroffene Betriebssysteme: - Sonstiges - UNIX - Windows

CVE-2026-15371

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Rapid7 Velociraptor <0.77.2 Rapid7 / Velociraptor		<0.77.2

CVE-2026-17535

Affected products

Known affected 1 product, the same list as for CVE-2026-15371

CVE-2026-18348

Affected products

Known affected 1 product, the same list as for CVE-2026-15371

CVE-2026-18635

Affected products

Known affected 1 product, the same list as for CVE-2026-15371

CVE-2026-18636

Affected products

Known affected 1 product, the same list as for CVE-2026-15371

CVE-2026-18638

Affected products

Known affected 1 product, the same list as for CVE-2026-15371

CVE-2026-18639

Affected products

Known affected 1 product, the same list as for CVE-2026-15371

CVE-2026-18640

Affected products

Known affected 1 product, the same list as for CVE-2026-15371

CVE-2026-18652

Affected products

Known affected 1 product, the same list as for CVE-2026-15371

CVE-2026-18860

Affected products

Known affected 1 product, the same list as for CVE-2026-15371

CVE-2026-18972

Affected products

Known affected 1 product, the same list as for CVE-2026-15371

CVE-2026-64951

Affected products

Known affected 1 product, the same list as for CVE-2026-15371

CVE-2026-64952

Affected products

Known affected 1 product, the same list as for CVE-2026-15371

CVE-2026-64953

Affected products

Known affected 1 product, the same list as for CVE-2026-15371

CVE-2026-64954

Affected products

Known affected 1 product, the same list as for CVE-2026-15371

CVE-2026-64955

Affected products

Known affected 1 product, the same list as for CVE-2026-15371

References

17 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://docs.velociraptor.app/announcements/advis…	external
https://docs.velociraptor.app/announcements/advis…	external
https://docs.velociraptor.app/announcements/advis…	external
https://docs.velociraptor.app/announcements/advis…	external
https://docs.velociraptor.app/announcements/advis…	external
https://docs.velociraptor.app/announcements/advis…	external
https://docs.velociraptor.app/announcements/advis…	external
https://docs.velociraptor.app/announcements/advis…	external
https://docs.velociraptor.app/announcements/advis…	external
https://docs.velociraptor.app/announcements/advis…	external
https://docs.velociraptor.app/announcements/advis…	external
https://docs.velociraptor.app/announcements/advis…	external
https://docs.velociraptor.app/announcements/advis…	external
https://docs.velociraptor.app/announcements/advis…	external
https://docs.velociraptor.app/announcements/advis…	external

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Rapid7 Velociraptor ist ein Tool zur Endpunkt-Erkennung und -Reaktion (EDR) und zur digitalen Forensik, das eine leistungsstarke Sammlung von Tools zur \u00dcberwachung und Analyse von Endpunkten bietet.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Rapid7 Velociraptor ausnutzen, um erweiterte Berechtigungen, einschlie\u00dflich Administratorrechte, zu erlangen, Sicherheitsma\u00dfnahmen zu umgehen, Spoofing- und Cross-Site-Scripting-Angriffe durchzuf\u00fchren, Daten zu manipulieren, sensible Informationen offenzulegen oder einen Denial-of-Service-Zustand auszul\u00f6sen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2728 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2728.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2728 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2728"
      },
      {
        "category": "external",
        "summary": "Rapid7 Velociraptor Advisory vom 2026-08-10",
        "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-15371/"
      },
      {
        "category": "external",
        "summary": "Rapid7 Velociraptor Advisory vom 2026-08-10",
        "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-17535/"
      },
      {
        "category": "external",
        "summary": "Rapid7 Velociraptor Advisory vom 2026-08-10",
        "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-18348/"
      },
      {
        "category": "external",
        "summary": "Rapid7 Velociraptor Advisory vom 2026-08-10",
        "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-18635/"
      },
      {
        "category": "external",
        "summary": "Rapid7 Velociraptor Advisory vom 2026-08-10",
        "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-18636/"
      },
      {
        "category": "external",
        "summary": "Rapid7 Velociraptor Advisory vom 2026-08-10",
        "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-18638/"
      },
      {
        "category": "external",
        "summary": "Rapid7 Velociraptor Advisory vom 2026-08-10",
        "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-18639/"
      },
      {
        "category": "external",
        "summary": "Rapid7 Velociraptor Advisory vom 2026-08-10",
        "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-18640/"
      },
      {
        "category": "external",
        "summary": "Rapid7 Velociraptor Advisory vom 2026-08-10",
        "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-18652/"
      },
      {
        "category": "external",
        "summary": "Rapid7 Velociraptor Advisory vom 2026-08-10",
        "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-18860/"
      },
      {
        "category": "external",
        "summary": "Rapid7 Velociraptor Advisory vom 2026-08-10",
        "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-18972/"
      },
      {
        "category": "external",
        "summary": "Rapid7 Velociraptor Advisory vom 2026-08-10",
        "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-64951/"
      },
      {
        "category": "external",
        "summary": "Rapid7 Velociraptor Advisory vom 2026-08-10",
        "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-64952/"
      },
      {
        "category": "external",
        "summary": "Rapid7 Velociraptor Advisory vom 2026-08-10",
        "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-64954/"
      },
      {
        "category": "external",
        "summary": "Rapid7 Velociraptor Advisory vom 2026-08-10",
        "url": "https://docs.velociraptor.app/announcements/advisories/cve-2026-64955/"
      }
    ],
    "source_lang": "en-US",
    "title": "Rapid7 Velociraptor: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-08-10T22:00:00.000+00:00",
      "generator": {
        "date": "2026-08-11T09:51:10.544+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2728",
      "initial_release_date": "2026-08-10T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-08-10T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c0.77.2",
                "product": {
                  "name": "Rapid7 Velociraptor \u003c0.77.2",
                  "product_id": "T057785"
                }
              },
              {
                "category": "product_version",
                "name": "0.77.2",
                "product": {
                  "name": "Rapid7 Velociraptor 0.77.2",
                  "product_id": "T057785-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rapid7:velociraptor:0.77.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Velociraptor"
          }
        ],
        "category": "vendor",
        "name": "Rapid7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-15371",
      "product_status": {
        "known_affected": [
          "T057785"
        ]
      },
      "release_date": "2026-08-10T22:00:00.000+00:00",
      "title": "CVE-2026-15371"
    },
    {
      "cve": "CVE-2026-17535",
      "product_status": {
        "known_affected": [
          "T057785"
        ]
      },
      "release_date": "2026-08-10T22:00:00.000+00:00",
      "title": "CVE-2026-17535"
    },
    {
      "cve": "CVE-2026-18348",
      "product_status": {
        "known_affected": [
          "T057785"
        ]
      },
      "release_date": "2026-08-10T22:00:00.000+00:00",
      "title": "CVE-2026-18348"
    },
    {
      "cve": "CVE-2026-18635",
      "product_status": {
        "known_affected": [
          "T057785"
        ]
      },
      "release_date": "2026-08-10T22:00:00.000+00:00",
      "title": "CVE-2026-18635"
    },
    {
      "cve": "CVE-2026-18636",
      "product_status": {
        "known_affected": [
          "T057785"
        ]
      },
      "release_date": "2026-08-10T22:00:00.000+00:00",
      "title": "CVE-2026-18636"
    },
    {
      "cve": "CVE-2026-18638",
      "product_status": {
        "known_affected": [
          "T057785"
        ]
      },
      "release_date": "2026-08-10T22:00:00.000+00:00",
      "title": "CVE-2026-18638"
    },
    {
      "cve": "CVE-2026-18639",
      "product_status": {
        "known_affected": [
          "T057785"
        ]
      },
      "release_date": "2026-08-10T22:00:00.000+00:00",
      "title": "CVE-2026-18639"
    },
    {
      "cve": "CVE-2026-18640",
      "product_status": {
        "known_affected": [
          "T057785"
        ]
      },
      "release_date": "2026-08-10T22:00:00.000+00:00",
      "title": "CVE-2026-18640"
    },
    {
      "cve": "CVE-2026-18652",
      "product_status": {
        "known_affected": [
          "T057785"
        ]
      },
      "release_date": "2026-08-10T22:00:00.000+00:00",
      "title": "CVE-2026-18652"
    },
    {
      "cve": "CVE-2026-18860",
      "product_status": {
        "known_affected": [
          "T057785"
        ]
      },
      "release_date": "2026-08-10T22:00:00.000+00:00",
      "title": "CVE-2026-18860"
    },
    {
      "cve": "CVE-2026-18972",
      "product_status": {
        "known_affected": [
          "T057785"
        ]
      },
      "release_date": "2026-08-10T22:00:00.000+00:00",
      "title": "CVE-2026-18972"
    },
    {
      "cve": "CVE-2026-64951",
      "product_status": {
        "known_affected": [
          "T057785"
        ]
      },
      "release_date": "2026-08-10T22:00:00.000+00:00",
      "title": "CVE-2026-64951"
    },
    {
      "cve": "CVE-2026-64952",
      "product_status": {
        "known_affected": [
          "T057785"
        ]
      },
      "release_date": "2026-08-10T22:00:00.000+00:00",
      "title": "CVE-2026-64952"
    },
    {
      "cve": "CVE-2026-64953",
      "product_status": {
        "known_affected": [
          "T057785"
        ]
      },
      "release_date": "2026-08-10T22:00:00.000+00:00",
      "title": "CVE-2026-64953"
    },
    {
      "cve": "CVE-2026-64954",
      "product_status": {
        "known_affected": [
          "T057785"
        ]
      },
      "release_date": "2026-08-10T22:00:00.000+00:00",
      "title": "CVE-2026-64954"
    },
    {
      "cve": "CVE-2026-64955",
      "product_status": {
        "known_affected": [
          "T057785"
        ]
      },
      "release_date": "2026-08-10T22:00:00.000+00:00",
      "title": "CVE-2026-64955"
    }
  ]
}

CVE-2026-18972 (GCVE-0-2026-18972)

Vulnerability from cvelistv5 – Published: 2026-08-11 12:30 – Updated: 2026-08-11 13:51

Title

Velociraptor authenticated identity-spoofing vulnerability

Summary

An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack from a user with low privileges to administrator.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 13:48 UTC

CWE

CWE-290 - Authentication bypass by spoofing

Assigner

rapid7 mitre root

References

1 reference

URL	Tags
http://docs.velociraptor.app/announcements/adviso…

Impacted products

1 product

Vendor	Product	Version
Rapid7	Velociraptor	Affected: 0 , < 0.77.2 (semver) cpe:2.3:a:rapid7:velociraptor::::::::

Credits

Yuval Miller Leon Kayaliev

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18972",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T13:48:57.252540Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T13:51:00.275Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Velociraptor",
          "repo": "https://github.com/Velocidex/velociraptor/",
          "vendor": "Rapid7",
          "versions": [
            {
              "lessThan": "0.77.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003eThe attacker must have access to the Velociraptor GUI with at least the \\\"reader\\\" role.\u003c/pre\u003e"
            }
          ],
          "value": "The attacker must have access to the Velociraptor GUI with at least the \\\"reader\\\" role."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.77.2",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yuval Miller"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Leon Kayaliev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003eAn authenticated attacker can spoof another GUI user\u0027s identity by sending their request with the custom header \\\"Grpc-Metadata-USER\\\". This can lead to an account takeover attack from a user with low privileges to administrator.\u003c/pre\u003e"
            }
          ],
          "value": "An authenticated attacker can spoof another GUI user\u0027s identity by sending their request with the custom header \\\"Grpc-Metadata-USER\\\". This can lead to an account takeover attack from a user with low privileges to administrator."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-21",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-21 Exploitation of Trusted Identifiers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication bypass by spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T12:30:52.574Z",
        "orgId": "9974b330-7714-4307-a722-5648477acda7",
        "shortName": "rapid7"
      },
      "references": [
        {
          "url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-18972/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Velociraptor authenticated identity-spoofing vulnerability",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003eIf you have a proxy in front of the Velociraptor GUI server, you can block the \\\"Grpc-Metadata-USER\\\" header.\u003c/pre\u003e"
            }
          ],
          "value": "If you have a proxy in front of the Velociraptor GUI server, you can block the \\\"Grpc-Metadata-USER\\\" header."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
    "assignerShortName": "rapid7",
    "cveId": "CVE-2026-18972",
    "datePublished": "2026-08-11T12:30:52.574Z",
    "dateReserved": "2026-08-05T16:09:39.892Z",
    "dateUpdated": "2026-08-11T13:51:00.275Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64951 (GCVE-0-2026-64951)

Vulnerability from cvelistv5 – Published: 2026-08-12 09:49 – Updated: 2026-08-12 12:29

Title

Velociraptor DoS triggered by Divide by Zero panic

Summary

A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process. The problem is a Divide by Zero bug in the ShouldPadFile() function.

Severity

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 12:28 UTC

CWE

CWE-369 - Divide by zero

Assigner

rapid7 mitre root

References

1 reference

URL	Tags
http://docs.velociraptor.app/announcements/adviso…

Impacted products

1 product

Vendor	Product	Version
Rapid7	Velociraptor	Affected: 0 , < 0.77.2 (semver)

Credits

Tristan Madani (Talence Security)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64951",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T12:28:55.260841Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T12:29:02.448Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Velociraptor",
          "repo": "https://github.com/Velocidex/velociraptor/",
          "vendor": "Rapid7",
          "versions": [
            {
              "lessThan": "0.77.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The attacker needs to obtain deployment credentials to be able to start a rogue client and upload a specially crafted sparse file.\u003cdiv\u003eTo successfully crash the server the Velociraptor user needs to export the file using the \"Expand Sparse Files\" option. If the option is not used the crash is not triggered.\u003c/div\u003e"
            }
          ],
          "value": "The attacker needs to obtain deployment credentials to be able to start a rogue client and upload a specially crafted sparse file.To successfully crash the server the Velociraptor user needs to export the file using the \"Expand Sparse Files\" option. If the option is not used the crash is not triggered."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tristan Madani (Talence Security)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process.\u003c/p\u003e\u003cdiv\u003eThe problem is a Divide by Zero bug in the\u0026nbsp;ShouldPadFile() function.\u003c/div\u003e"
            }
          ],
          "value": "A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process.\n\nThe problem is a Divide by Zero bug in the\u00a0ShouldPadFile() function."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-369",
              "description": "CWE-369 Divide by zero",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T09:49:25.635Z",
        "orgId": "9974b330-7714-4307-a722-5648477acda7",
        "shortName": "rapid7"
      },
      "references": [
        {
          "url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-64951/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Velociraptor DoS triggered by Divide by Zero panic",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Usually the server will restart after the crash. The user should then export the file without the \"Expand Sparse Files\" option.\u0026nbsp;"
            }
          ],
          "value": "Usually the server will restart after the crash. The user should then export the file without the \"Expand Sparse Files\" option."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
    "assignerShortName": "rapid7",
    "cveId": "CVE-2026-64951",
    "datePublished": "2026-08-12T09:49:25.635Z",
    "dateReserved": "2026-07-21T08:32:47.510Z",
    "dateUpdated": "2026-08-12T12:29:02.448Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64952 (GCVE-0-2026-64952)

Vulnerability from cvelistv5 – Published: 2026-08-12 09:44 – Updated: 2026-08-12 12:30

Title

Velociraptor Hunt Deletion With Insufficient Permission Check

Summary

The hunt_delete() VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "investigator" role) instead of the "DELETE_RESULTS" permission (usually only assigned to "administrators").

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 12:30 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

rapid7 mitre root

References

1 reference

URL	Tags
http://docs.velociraptor.app/announcements/adviso…

Impacted products

1 product

Vendor	Product	Version
Rapid7	Velociraptor	Affected: 0 , < 0.77.2 (semver)

Credits

Tristan Madani (Talence Security)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64952",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T12:30:13.302606Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T12:30:22.032Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Velociraptor",
          "repo": "https://github.com/Velocidex/velociraptor/",
          "vendor": "Rapid7",
          "versions": [
            {
              "lessThan": "0.77.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The attacker should have at least COLLECT_CLIENT permission (investigator role)"
            }
          ],
          "value": "The attacker should have at least COLLECT_CLIENT permission (investigator role)"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tristan Madani (Talence Security)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe hunt_delete() VQL function allows deleting hunts.\u0026nbsp;\u003c/p\u003e\u003cdiv\u003eVelociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the \"investigator\" role) instead of the \"DELETE_RESULTS\" permission (usually only assigned to \"administrators\").\u003c/div\u003e"
            }
          ],
          "value": "The hunt_delete() VQL function allows deleting hunts.\u00a0\n\nVelociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the \"investigator\" role) instead of the \"DELETE_RESULTS\" permission (usually only assigned to \"administrators\")."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T09:44:53.125Z",
        "orgId": "9974b330-7714-4307-a722-5648477acda7",
        "shortName": "rapid7"
      },
      "references": [
        {
          "url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-64952/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Velociraptor Hunt Deletion With Insufficient Permission Check",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
    "assignerShortName": "rapid7",
    "cveId": "CVE-2026-64952",
    "datePublished": "2026-08-12T09:44:53.125Z",
    "dateReserved": "2026-07-21T08:32:47.510Z",
    "dateUpdated": "2026-08-12T12:30:22.032Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64954 (GCVE-0-2026-64954)

Vulnerability from cvelistv5 – Published: 2026-08-12 04:26 – Updated: 2026-08-13 15:10

Title

Velociraptor collect_client() Permissions Bypass

Summary

Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 15:10 UTC

CWE

CWE-862 - Missing Authorization

Assigner

rapid7 mitre root

References

2 references

URL	Tags
http://docs.velociraptor.app/announcements/adviso…
https://github.com/Velocidex/velociraptor/commit/…

Impacted products

1 product

Vendor	Product	Version
Rapid7	Velociraptor	Affected: 0 , < 0.77.2 (semver)

Credits

Reported independently by Tristan Madani (Talence Security) Reported independently by Yuval Miller Reported independently by Leon Kayaliev

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64954",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T15:10:40.534655Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T15:10:57.773Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Velociraptor",
          "repo": "https://github.com/Velocidex/velociraptor/",
          "vendor": "Rapid7",
          "versions": [
            {
              "lessThan": "0.77.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "User must have the NOTEBOOK_EDIT permission normally given to the \"analyst\" role."
            }
          ],
          "value": "User must have the NOTEBOOK_EDIT permission normally given to the \"analyst\" role."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Reported independently by Tristan Madani (Talence Security)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Reported independently by Yuval Miller"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Reported independently by Leon Kayaliev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider.\u003cbr\u003e\u003cbr\u003eThis allows a user who can run arbitrary VQL (usually with the \"analyst\" role) to launch new collections (usually requires the \"investigator\" role). This vulnerability is an escalation from an analyst to investigator role."
            }
          ],
          "value": "Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider.\n\nThis allows a user who can run arbitrary VQL (usually with the \"analyst\" role) to launch new collections (usually requires the \"investigator\" role). This vulnerability is an escalation from an analyst to investigator role."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T04:26:32.169Z",
        "orgId": "9974b330-7714-4307-a722-5648477acda7",
        "shortName": "rapid7"
      },
      "references": [
        {
          "url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-64954/"
        },
        {
          "url": "https://github.com/Velocidex/velociraptor/commit/d7de958e846d3742a7a3a8538fd463e4f12fc528"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Velociraptor collect_client() Permissions Bypass",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
    "assignerShortName": "rapid7",
    "cveId": "CVE-2026-64954",
    "datePublished": "2026-08-12T04:26:32.169Z",
    "dateReserved": "2026-07-21T08:32:47.510Z",
    "dateUpdated": "2026-08-13T15:10:57.773Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64955 (GCVE-0-2026-64955)

Vulnerability from cvelistv5 – Published: 2026-08-12 09:39 – Updated: 2026-08-12 12:29

Title

Velociraptor CSV Formula Injection in Export Pipeline

Summary

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not clear if the vulnerability is actually in Microsoft Excel treating a CSV data file as executable content, or if Velociraptor should be sanitizing the data to prevent Excel from executing it. However, since this is such a common use case for Velociraptor we decided to highlight it in an advisory.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 12:29 UTC

CWE

CWE-1236 - Improper neutralization of formula elements in a CSV file

Assigner

rapid7 mitre root

References

1 reference

URL	Tags
http://docs.velociraptor.app/announcements/adviso…

Impacted products

1 product

Vendor	Product	Version
Rapid7	Velociraptor	Affected: 0 , < 0.77.2 (semver)

Credits

Tristan Madani (Talence Security)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64955",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T12:29:19.765452Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T12:29:40.570Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Velociraptor",
          "repo": "https://github.com/Velocidex/velociraptor/",
          "vendor": "Rapid7",
          "versions": [
            {
              "lessThan": "0.77.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This is only an issue if the exported CSV files are subsequently opened in Microsoft Excel."
            }
          ],
          "value": "This is only an issue if the exported CSV files are subsequently opened in Microsoft Excel."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tristan Madani (Talence Security)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eWhen Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution.\u0026nbsp;\u003c/p\u003e\u003cdiv\u003eVelociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports.\u003c/div\u003e\u003cdiv\u003eIt is not clear if the vulnerability is actually in Microsoft Excel treating a CSV data file as executable content, or if Velociraptor should be sanitizing the data to prevent Excel from executing it. However, since this is such a common use case for Velociraptor we decided to highlight it in an advisory.\u003c/div\u003e"
            }
          ],
          "value": "When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution.\u00a0\n\nVelociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports.\n\nIt is not clear if the vulnerability is actually in Microsoft Excel treating a CSV data file as executable content, or if Velociraptor should be sanitizing the data to prevent Excel from executing it. However, since this is such a common use case for Velociraptor we decided to highlight it in an advisory."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1236",
              "description": "CWE-1236 Improper neutralization of formula elements in a CSV file",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T09:39:26.928Z",
        "orgId": "9974b330-7714-4307-a722-5648477acda7",
        "shortName": "rapid7"
      },
      "references": [
        {
          "url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-64955/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Velociraptor CSV Formula Injection in Export Pipeline",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Never open exported CSV files using Microsoft Excel or Google Docs. Libreoffice was tested to not be vulnerable to this issue so it can be used safely."
            }
          ],
          "value": "Never open exported CSV files using Microsoft Excel or Google Docs. Libreoffice was tested to not be vulnerable to this issue so it can be used safely."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
    "assignerShortName": "rapid7",
    "cveId": "CVE-2026-64955",
    "datePublished": "2026-08-12T09:39:26.928Z",
    "dateReserved": "2026-07-21T08:32:47.510Z",
    "dateUpdated": "2026-08-12T12:29:40.570Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.