CVE-2026-115805— Rapid7 Insight Agent Local Privilege Escalation via Shell Injection in mcp.json Configuration Path
Quick assessment
Affected
Rapid7 Insight Agent
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Rapid7 Insight Agent 在 Linux 和 macOS 系统上对本地文件系统路径的处理存在缺陷，可能导致已认证的本地用户获取更高权限。利用该漏洞需要攻击者已具备本地访问权限，且依赖于 Agent 的资产清单收集功能处理恶意构造的路径。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1548.001 · Setuid and SetgidAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Rapid7 | Insight Agent | < 4.1.4.43 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-115805
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rapid7 Insight Agent Local Privilege Escalation via Shell Injection in mcp.json Configuration Path
Source: CVE Program / CVE List V5
Vulnerability Description
Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local users to gain elevated privileges. Exploitation requires existing local access and depends on the Agent's inventory collection processing the crafted path.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Rapid7 | Insight Agent | 0 ~ 4.1.4.43 | - |
|
II. Public POCs for CVE-2026-115805
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-115805
请登录查看更多情报信息。
Other References for CVE-2026-115805 (1)
IV. Related Vulnerabilities
Same product: Insight Agent
-
CVE-2026-89325
Rapid7 Insight Agent: Uncontrolled search path element in In -
CVE-2026-6482
Local Privilege Escalation via OpenSSL configuration file in -
CVE-2026-4482
Insight Agent Private Key Information Disclosure via Inherit -
CVE-2026-4837
Eval Injection in Rapid7 Insight Agent -
CVE-2024-3185
Rapid7 Insight Agent Sensitive Key Exposed To Local Users
Same vendor: Rapid7
-
CVE-2026-109682
Metasploit Framework HTTP Redirect Server-Side Request Forge -
CVE-2026-109681
Metasploit Framework FTP PASV Response SSRF -
CVE-2026-87689
Metasploit Framework Web Service REST API Missing Authentica -
CVE-2026-87690
Metasploit Framework ios_image_gather Path Traversal Leading -
CVE-2026-78413
Velociraptor privilege escalation via SysmonLogForward clien
Same weakness: CWE-78
-
CVE-2026-90868
OS Command Injection in Progress WS_FTP Server -
CVE-2026-90865
Command Injection via FTP Notification Variables in Progress -
CVE-2026-104308
Langflow OSS is affected by multiple vulnerabilities -
CVE-2026-107326
Langflow OSS is affected by multiple vulnerabilities -
CVE-2026-97854
雅马哈 NWR100 路由器存在 OS 命令注入漏洞