{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3arapid7insight_agentlinux/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rapid7:insight_agent:*:*:*:*:*:linux:*:*","cpe:2.3:a:rapid7:insight_agent:*:*:*:*:*:macos:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-115805"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Insight Agent"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","vulnerability","endpoint-security"],"_cs_type":"advisory","_cs_vendors":["Rapid7"],"content_html":"\u003cp\u003eCVE-2026-115805 is a privilege escalation vulnerability in the Rapid7 Insight Agent on Linux and macOS. The vulnerability exists due to improper handling of local filesystem paths during the agent's inventory collection process. An authenticated local user can exploit this flaw by providing a crafted filesystem path that the agent processes with elevated privileges, resulting in unauthorized privilege escalation on the affected host.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn authenticated local user can escalate privileges on the host system. This requires the attacker to have existing local access to the system and the ability to influence paths processed by the agent.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all systems running the Rapid7 Insight Agent on Linux and macOS.\u003c/li\u003e\n\u003cli\u003eMonitor Rapid7 security bulletins for patch availability for CVE-2026-115805 and deploy immediately to affected agents.\u003c/li\u003e\n\u003cli\u003eRestrict local user permissions on systems where the Insight Agent is deployed to limit the ability to place or manipulate filesystem paths accessible to the agent process.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-29T17:51:00Z","date_published":"2026-10-29T17:51:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rapid7-insight-agent-privesc/","summary":"A vulnerability in the Rapid7 Insight Agent for Linux and macOS allows an authenticated local user to achieve privilege escalation by supplying a crafted filesystem path during inventory collection.","title":"Rapid7 Insight Agent: Local privilege escalation (CVE-2026-115805)","url":"https://feed.craftedsignal.io/briefs/2026-10-rapid7-insight-agent-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:rapid7:insight_agent:*:*:*:*:*:linux:*:*","version":"https://jsonfeed.org/version/1.1"}