CVE Intelligence
Analysis AI-assisted

CVE-2026-8660: Rapid7 InsightConnect Ping Plugin OS Command Injection

A critical OS command injection flaw (CWE-78) in the ping action of the Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to run arbitrary OS commands through the host parameter. NVD scores it 9.8 (CVSS 3.1), while the CNA Rapid7 scores it 7.7. The record lists versions below 1.0.4 as affected, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A critical OS command injection vulnerability (CWE-78) affects the ping action of the Rapid7 InsightConnect Ping Plugin when it runs on Linux. According to the record, the host parameter is not validated sufficiently when shell commands are built, which may allow a remote attacker to run arbitrary operating system commands.

Impact

  • NVD rates the issue 9.8 under CVSS 3.1 (critical), with high confidentiality, integrity and availability impact and no privileges or user interaction required.
  • Rapid7, acting as CNA, rates it 7.7 under CVSS 3.1.
  • Successful exploitation would run commands with the privileges of the plugin execution context, which the record does not specify (unknown).

Affected products and versions

  • Rapid7 InsightConnect Ping Plugin on Linux, versions below 1.0.4.
  • The record contains no explicit fixed-version entry. Version 1.0.4 appears to be the first unaffected release based on the upper bound of the affected range. Confirm on the vendor extension page.

Exploitation status

The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted. EPSS and SSVC data are not available in the record.

Remediation and mitigation

  • Inventory deployments of the Ping Plugin and identify any instances running on Linux.
  • Upgrade to version 1.0.4 or later, verifying the target version against the vendor page.
  • Until the plugin is updated, limit which users and automated workflows can invoke the ping action, and restrict network reachability of the hosts running it.
  • Review workflows that pass externally sourced values into the host input.

Detection guidance

  • Review plugin logs for unusual host values or unexpected child processes spawned by the plugin runtime.
  • Monitor automation hosts running the plugin for unexpected outbound connections or newly created processes.

Limitations of the available information

The record provides no vendor advisory text beyond the product page, no fixed-version entry, no EPSS or SSVC values, and no detail on default configurations. Exact vulnerable code paths and reliable log signatures are unknown.

Frequently asked questions

Is this vulnerability being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. Its critical score still warrants prompt attention.

Which versions are affected?

The record lists Rapid7 InsightConnect Ping Plugin versions below 1.0.4 as affected when running on Linux.

What should administrators do?

Identify plugin instances on Linux, upgrade to 1.0.4 or later after checking the vendor page, and restrict who and what can reach the ping action in the meantime.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.