CVE-2026-8666: Rapid7 InsightConnect Traceroute Plugin OS Command Injection
CVE-2026-8666 is an OS command injection flaw in the traceroute action of the Rapid7 InsightConnect Traceroute Plugin on Linux, classified as CWE-78. NVD scores it 9.8 (CVSS 3.1, critical), while the CNA Rapid7 scores it 7.7. The record lists affected versions below 1.0.3 and does not show exploitation in the sources consulted.
Overview
CVE-2026-8666 affects the traceroute action of the Rapid7 InsightConnect Traceroute Plugin when it runs on Linux. The record describes insufficient input validation when the plugin builds shell commands, which is the root cause of an OS command injection weakness (CWE-78).
Impact
According to the record, a remote attacker could execute arbitrary OS commands through the host, port, max_ttl, count, or time_out request parameters. NVD assigns a CVSS 3.1 base score of 9.8 with a vector that indicates network access, low complexity, no privileges, no user interaction, and high confidentiality, integrity, and availability impact. The CNA Rapid7 assigns 7.7 for the same CVE.
Affected products and versions
- Product: Rapid7 InsightConnect Traceroute Plugin (Linux).
- Affected range in the record: versions below 1.0.3.
- Fixed versions: the record does not list any fix. The affected range suggests that 1.0.3 is the first version outside the range, but this is an inference that should be confirmed with the vendor.
Exploitation status
The record indicates that the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted for this analysis. This does not rule out exploitation, and the status should be rechecked as new information becomes available.
Remediation and mitigation
- Identify all deployments of the Rapid7 InsightConnect Traceroute Plugin and their versions, especially on Linux.
- Plan an upgrade to a version outside the affected range, such as 1.0.3 or later, after confirming the fixed version with the vendor's extension page at Rapid7 extension catalog.
- Until the update is applied, restrict which users and workflows can invoke the traceroute action and limit network exposure of the systems running it.
- Review logs for unexpected process execution originating from the plugin's runtime.
Detection guidance
- Monitor the orchestration platform and plugin logs for traceroute executions with unusual or malformed values in the host, port, max_ttl, count, or time_out fields.
- Watch for child processes spawned by the plugin runtime that are not part of normal traceroute behavior.
- Correlate such events with authentication and workflow records to identify the initiating user or integration.
Limitations of the available information
The available record does not include a vendor advisory, a confirmed fixed version, EPSS, or SSVC data. Details about which Linux distributions or plugin packaging formats are affected are not stated. Information about the Rapid7 score difference between NVD and the CNA is not explained in the record.
Frequently asked questions
What is CVE-2026-8666?
It is an OS command injection vulnerability in the traceroute action of the Rapid7 InsightConnect Traceroute Plugin on Linux, caused by insufficient input validation when shell commands are built.
Which versions are affected?
The record lists versions below 1.0.3 as affected. It does not list a confirmed fixed version, so the vendor should be consulted before upgrading.
Is this vulnerability being exploited?
The record indicates it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The status should be rechecked over time.
What should administrators do now?
Inventory affected deployments, plan an upgrade to a version outside the affected range, restrict who can invoke the traceroute action, and monitor logs for unusual executions.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.