CVE-2026-8665: Rapid7 InsightConnect Translate Plugin OS Command Injection (TR Action)
CVE-2026-8665 is an OS command injection flaw in the TR action of the Rapid7 InsightConnect Translate Plugin on Linux, published with Rapid7 as the CNA. The record states that remote attackers can run arbitrary OS commands through the text or expression parameters because input is not sanitized sufficiently before shell commands are built. NVD lists a CVSS 3.1 base score of 9.8 and the CNA lists 7.7, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-8665 affects the TR action of the Rapid7 InsightConnect Translate Plugin when run on Linux. The weakness is classified as CWE-78, OS Command Injection. According to the record, the text and expression parameters are not sanitized enough before they are used to build shell commands.
Impact
The record describes remote attackers executing arbitrary operating system commands. NVD scores the issue at 9.8 under CVSS 3.1 with high confidentiality, integrity and availability impact, while the CNA score is 7.7. Because the two scores differ, organizations should check the scoring basis in each source before setting priority.
Affected products and versions
- Rapid7 InsightConnect Translate, versions below 2.0.3, according to the affected range in the record.
- The record does not list a fixed version. The range suggests that 2.0.3 and later fall outside the stated affected range, but the vendor's own advisory should confirm this.
Exploitation status
The KEV catalog does not list this CVE, and no EPSS data is present in the record. No confirmed exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- Identify every deployment of the Rapid7 InsightConnect Translate Plugin and confirm its version.
- Upgrade to version 2.0.3 or later, or to the version the vendor specifies as fixed, using the Rapid7 extension page.
- Until the update is applied, limit which users and workflows can reach the TR action, and restrict network exposure of the systems running the plugin.
- Review whether inputs passed to the text and expression parameters come from untrusted sources.
Detection guidance
- Review logs of the systems running the plugin for unexpected child processes spawned by the integration runtime.
- Look for unusual outbound network connections or file changes originating from the automation host.
- Audit recent executions of the TR action for atypical or unexpected input values.
Limitations of the available information
The record has no title, no fixed version, no KEV data, no EPSS score and no SSVC data. The sources do not describe the exact vulnerable code path, and the two CVSS scores have not been reconciled. Exploit availability is unknown from this record.
Frequently asked questions
What is CVE-2026-8665?
It is an OS command injection vulnerability in the TR action of the Rapid7 InsightConnect Translate Plugin on Linux. The record says the text and expression parameters are not sanitized enough before shell commands are built.
Which versions are affected?
The record lists Rapid7 InsightConnect Translate versions below 2.0.3. No fixed version is listed in the record, so the vendor's advisory should be checked.
Is this vulnerability being exploited?
The KEV catalog does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted.
What should administrators do?
Identify all deployments of the plugin, update to version 2.0.3 or later or the vendor's fixed version, and restrict access to the TR action until the update is applied.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.