By vendor
Rapid7 vulnerabilities
Known CVEs affecting Rapid7 products, prioritized by severity, with SEC.co remediation and detection guidance.
9 published vulnerabilities
- CVE-2026-8592HIGH 7.7
A critical flaw in Rapid7's InsightConnect AWK Plugin allows attackers to run arbitrary commands on Linux systems. The vulnerability exists in how the plugin processes text and expressions, failing to properly sanitize user input before passing it to shell commands. An attacker without credentials can exploit this remotely to gain full command execution on affected systems.
- CVE-2026-8660HIGH 7.7
A command injection vulnerability exists in Rapid7's InsightConnect Ping Plugin on Linux systems. The vulnerability stems from improper handling of user-supplied input in the ping action's host parameter. An unauthenticated attacker can craft malicious input that breaks out of the intended ping command and executes arbitrary operating system commands with the privileges of the InsightConnect process. This is a network-accessible vulnerability that requires no user interaction or authentication to exploit.
- CVE-2026-8665HIGH 7.7
A command injection vulnerability exists in Rapid7 InsightConnect's Translate Plugin on Linux systems. An attacker can send specially crafted requests containing malicious input in the text or expression parameters of the TR action, which the plugin fails to properly sanitize before using in shell commands. This allows remote execution of arbitrary operating system commands with the privileges of the InsightConnect process. No authentication is required to exploit this vulnerability.
- CVE-2026-8666HIGH 7.7
A flaw in Rapid7's InsightConnect Traceroute Plugin allows attackers to inject and execute arbitrary operating system commands on Linux systems. The vulnerability exists because the plugin fails to properly validate user-supplied input—specifically the host, port, max_ttl, count, or time_out parameters—before using them to construct shell commands. An attacker with network access can exploit this to run malicious commands with the privileges of the plugin process, potentially compromising the affected system.
- CVE-2026-8658MEDIUM 6.0
A command injection flaw in Rapid7's InsightConnect Tcpdump Plugin allows authenticated users with high-level privileges to run arbitrary system commands on Linux servers. The vulnerability exists because user-supplied options and filter parameters aren't properly sanitized before being passed to shell commands. An attacker with administrative or equivalent access to InsightConnect could exploit this to execute malicious code with the privileges of the plugin process.
- CVE-2026-8659MEDIUM 6.0
A security flaw in Rapid7 InsightConnect's SQLmap plugin allows authenticated users with administrative privileges to run arbitrary commands on affected Linux systems. The vulnerability exists in how the plugin processes connection configuration parameters—specifically the api_host and api_port fields—without properly validating or sanitizing the input. An attacker with legitimate access to the InsightConnect platform could exploit this to execute unintended system commands on the underlying Linux host, potentially compromising system integrity or confidentiality.
- CVE-2026-8663MEDIUM 6.0
A flaw in Rapid7's InsightConnect RPM Plugin for Linux allows authenticated users to run arbitrary commands on affected systems. The vulnerability stems from the plugin's failure to properly sanitize user input when constructing shell commands—specifically in how it handles repository names, package keys, and package names. An attacker with valid credentials could exploit this to execute unauthorized operating system commands, potentially compromising system integrity or accessing sensitive data.
- CVE-2026-8664MEDIUM 6.0
A command injection flaw in the Rapid7 InsightConnect Finger Plugin allows authenticated users with high privileges to inject arbitrary operating system commands through the user or host input fields. An attacker with admin or elevated access could exploit insufficient input validation to execute unauthorized commands on the underlying Linux system, potentially compromising system integrity or accessing sensitive data.
- CVE-2026-8662LOW 3.3
A path traversal flaw exists in Rapid7 InsightConnect's Compression Plugin on Linux systems. An authenticated attacker can supply specially crafted filenames to the create_archive function that cause files to be written outside their intended directory. However, because the attacker cannot control the file contents—only the path—the damage is limited to corrupting legitimate files rather than injecting malicious data. Exploitation requires valid credentials, making this primarily a risk for insider threats or compromised service accounts.