Sentinel update: cross-org event access fixed in Velociraptor
Velociraptor's WatchEvent API let a user with API access in one org stream live events from another org. Rapid7 fixed it in v0.77.3.
Mobasi Research
This Sentinel update covers a second Velociraptor vulnerability, which became public on October 5, 2026. Rapid7 published it as CVE-2026-78412.
Velociraptor
One Velociraptor server can hold many orgs. Each org keeps its own endpoints, users, and data. Teams that support more than one client often put each client in a different org.
Cross-Org Event Read via the WatchEvent API
medium- Issue
- The
WatchEventgRPC API lets the caller name the org to stream events from. The server checked permissions against the caller's own org, not the requested org. - Impact
- A user with API access in one org can read live events from another org on the same server, with no access to that org.
- Advisory
- CVE-2026-78412
Rapid7 fixed the issue in Velociraptor v0.77.3, released October 5, 2026. Update to v0.77.3 or later.
Current Sentinel index
The Sentinel page remains the running public index of disclosed vulnerabilities and remediation status across our reviews.