CVE Intelligence
Analysis AI-assisted

CVE-2026-1568: Rapid7 InsightVM Improper Authentication in ACS Assertion Handling

Rapid7 InsightVM versions before 8.34.0 reportedly fail to verify signatures on assertions received at the Assertion Consumer Service (ACS) cloud endpoint, which the record says could allow account takeover of accounts set up through Security Console installations. The CNA rates the issue critical with a CVSS 3.1 base score of 9.6. The description states the issue is fixed in version 8.34.0, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a signature verification weakness in Rapid7 InsightVM on the Assertion Consumer Service (ACS) cloud endpoint. It is classified as Improper Authentication (CWE-287) and was published on 2026-02-03.

Impact

  • The record states that an attacker could gain unauthorized access to InsightVM accounts set up through Security Console installations, resulting in full account takeover.
  • According to the record, the application processes unsigned assertions and issues session cookies that grant access to the targeted user accounts.
  • The CNA's CVSS 3.1 base score is 9.6, with network attack vector, low attack complexity, low privileges required, no user interaction, changed scope, and high confidentiality and integrity impact. The availability impact is listed as none.

Affected products and versions

  • Product: Rapid7 InsightVM.
  • Affected versions as stated in the description: versions before 8.34.0.
  • The record does not provide a structured list of affected versions or a lower bound.
  • Fixed version stated in the description: 8.34.0.

Exploitation status

  • The CISA KEV entry in the record is marked as not listed, so this analysis does not state that the issue is exploited in the wild.
  • No confirmed exploitation appears in the sources consulted.
  • No EPSS score is available in the record.

Remediation and mitigation

  • Upgrade InsightVM to version 8.34.0 or later, which the description identifies as the fixed release.
  • Review the Rapid7 Command Platform release notes for upgrade context: Rapid7 Command Platform release notes.
  • Until the upgrade is complete, restrict who can reach Security Console installations and review accounts that are accessed through the ACS integration.

Detection guidance

  • Review authentication and session logs for InsightVM user accounts, looking for sessions that have no matching legitimate sign-in event.
  • Correlate identity provider assertion events with console session creation to identify anomalies.
  • Watch for account activity from unfamiliar sources or at unusual times.

Limitations of the available information

  • The record does not include a vendor advisory with technical details about the signature check or the affected deployment configurations.
  • Whether the cloud endpoint required any customer action beyond the product upgrade is not stated.
  • It is unknown whether the issue has been exploited outside the sources consulted.

Frequently asked questions

Which InsightVM versions are affected by CVE-2026-1568?

The description states that versions before 8.34.0 are affected. The record does not provide a structured list of affected versions or a lower bound.

What version fixes CVE-2026-1568?

The description states that the issue is fixed in InsightVM version 8.34.0.

Is CVE-2026-1568 known to be actively exploited?

The CISA KEV entry in the record is not listed, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.