- Severity: MEDIUM
- CVE: CVE-2026-85737
- Ecosystems: go
- Packages: www.velocidex.com/golang/velociraptor
## Summary
The `sql()` VQL plugin runs a caller-supplied database driver and connection string with no permission check (`vql/parsers/sql/sql.go:93`, `SQLPlugin.Call`). For `driver=’mysql’` or `driver=’postgres’` the handle comes from `GetHandleOther` (`sql.go:39`), which passes the connection string straight to Go `database/sql` `sql.Open` (`sql.go:51`) and executes the query (`sql.go:159`).
The plugin declares `FILESYSTEM_READ` only as `Info().Permissions` metadata (`sql.go:219`). That metadata is never consulted at runtime: `metadata.go:19` stores it as a string that only the documentation exporter reads (`api/reflect.go:82-110`). Every sibling network plugin (`http_client`, `netcat`, `s3`, `rsyslog`) calls `CheckAccess(acls.NETWORK)` in its own body; `sql()` calls nothing.
The built-in `analyst` role holds `ANY_QUERY` but not `FILESYSTEM_READ` or `NETWORK` (`acls/roles.go:222`), and reaches this sink through the notebook query API.
Result: a low-priv analyst opens arbitrary outbound TCP connections and, through a rogue MySQL server’s `LOAD DATA LOCAL INFILE`, reads any file the root-running server can read, including the deployment CA private key.
## Affected
– Velocidex/velociraptor server, `
Source: GitHub Security Advisories · 2026-11-09