Is CVE-2026-78411 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-78411?

CVE-2026-78411 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-78411

Description

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server admin.