Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-115805

Rapid7 Insight Agent Local Privilege Escalation via Shell Injection in mcp.json Configuration Path

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
rapid7

Description

Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local users to gain elevated privileges. Exploitation requires existing local access and depends on the Agent's inventory collection processing the crafted path.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Rapid7 Insight Agent

Default version status: unaffected

  • 0 to < 4.1.4.43affected

References