CVE-2026-8665: Rapid7 InsightConnect Translate Plugin Command Injection

Technical summary

CVE-2026-8665 is an OS command injection flaw (CWE-78) in the TR action handler of the Rapid7 InsightConnect Translate Plugin. The vulnerability stems from insufficient input validation and sanitization of the text and expression parameters before they are incorporated into shell command construction. On Linux environments, an attacker can inject shell metacharacters and commands that bypass the intended logic and execute arbitrary system commands. The CVSS 3.1 score of 7.7 (HIGH) reflects the combination of network accessibility, lack of authentication requirements, high impact on confidentiality and integrity, and partial impact on availability. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L indicates that while the attack is network-based and requires no privileges or user interaction, there is a moderately high attack complexity factor, likely due to exploitation prerequisites or encoding requirements.

Business impact

Successful exploitation enables an attacker to execute arbitrary commands on the Linux system hosting InsightConnect. This can lead to unauthorized data access, modification or deletion of critical orchestration workflows, lateral movement within your infrastructure, or system compromise. For organizations relying on InsightConnect for security automation and incident response, this vulnerability could undermine the integrity of automated security operations, potentially allowing attackers to disable monitoring, suppress alerts, or manipulate remediation workflows.

Affected systems

The vulnerability specifically affects the Rapid7 InsightConnect Translate Plugin on Linux systems. Organizations using InsightConnect for orchestration and automation should audit their environments to identify instances running the affected plugin. Note that this is a plugin-level vulnerability and affects Linux deployments; verify your specific InsightConnect version and plugin configuration against Rapid7's official advisory to determine your exposure.

Exploitability

The vulnerability is remotely exploitable without requiring authentication or user interaction, which significantly lowers the barrier to attack. However, the CVSS vector indicates moderately high attack complexity, suggesting that exploitation may require knowledge of the plugin's URL paths, action names, or specific parameter formatting. Once an attacker identifies a vulnerable instance, crafting the actual exploit is likely straightforward since shell injection techniques are well-established. The lack of CISA KEV listing at the time of data collection does not diminish the severity—it reflects publication timing and does not indicate a lower practical risk.

Remediation

Apply patches from Rapid7 that address input sanitization in the Translate Plugin's TR action handler. Rapid7's official security advisory will provide specific patch versions and upgrade paths. Until patching is possible, consider network-level controls: restrict access to InsightConnect interfaces to trusted sources only, implement network segmentation to limit exposure, and disable the Translate Plugin if it is not actively required. Ensure strong access controls on systems hosting InsightConnect, and monitor for unusual process execution patterns originating from the InsightConnect service.

Patch guidance

Consult Rapid7's official security advisory and release notes to identify the patched version for the Translate Plugin. Test patches in a non-production environment first, as they may affect dependent workflows or automation rules. Verify that your update does not break downstream processes that depend on the TR action. Rapid7 typically provides detailed migration guidance in security bulletins; follow those instructions carefully. If you maintain custom integrations using the Translate Plugin, review them post-patch to ensure continued compatibility.

Detection guidance

Monitor logs from InsightConnect for unusual invocations of the TR action, particularly those with unexpected special characters (backticks, pipes, semicolons, dollar signs, ampersands) in the text or expression parameters. Examine system-level process execution logs (auditd, syslog, or osquery on Linux) for child processes spawned by the InsightConnect service that are not consistent with normal automation workflows. Look for patterns such as unusual command execution from the InsightConnect daemon user, execution of shells (bash, sh), or commands that appear to be reconnaissance or persistence mechanisms. Network-based detection should flag requests to InsightConnect endpoints containing encoded or obfuscated shell metacharacters.

Why prioritize this

This vulnerability merits high prioritization due to the combination of remote exploitability without authentication, HIGH severity (CVSS 7.7), and the critical role that InsightConnect often plays in security orchestration. A compromised InsightConnect instance could become a pivot point for lateral movement or allow attackers to suppress security alerts. Organizations using InsightConnect should treat this as urgent and allocate resources to identify affected versions and deploy patches quickly.

Risk score, explained

The CVSS 3.1 score of 7.7 reflects a remote, unauthenticated attack vector (AV:N, PR:N, UI:N) with high impact on confidentiality and integrity (C:H, I:H) and low impact on availability (A:L). The moderately high attack complexity (AC:H) prevents the score from reaching the critical threshold, suggesting that successful exploitation requires specific knowledge or conditions. The score appropriately captures the serious nature of remote code execution while acknowledging that the attack is not trivial to execute blindly. This places the vulnerability in the upper tier of HIGH severity, warranting immediate attention.

Frequently asked questions