Cpe:2.3:a:rapid7:insight_agent:*:*:*:*:*:linux:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3arapid7insight_agentlinux/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 17:51:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRapid7 Insight Agent: Local privilege escalation (CVE-2026-115805)https://feed.craftedsignal.io/briefs/2026-10-rapid7-insight-agent-privesc/Thu, 29 Oct 2026 17:51:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-rapid7-insight-agent-privesc/A vulnerability in the Rapid7 Insight Agent for Linux and macOS allows an authenticated local user to achieve privilege escalation by supplying a crafted filesystem path during inventory collection.CVE-2026-115805 is a privilege escalation vulnerability in the Rapid7 Insight Agent on Linux and macOS. The vulnerability exists due to improper handling of local filesystem paths during the agent's inventory collection process. An authenticated local user can exploit this flaw by providing a crafted filesystem path that the agent processes with elevated privileges, resulting in unauthorized privilege escalation on the affected host.

Impact

An authenticated local user can escalate privileges on the host system. This requires the attacker to have existing local access to the system and the ability to influence paths processed by the agent.

Recommendation

  1. Inventory all systems running the Rapid7 Insight Agent on Linux and macOS.
  2. Monitor Rapid7 security bulletins for patch availability for CVE-2026-115805 and deploy immediately to affected agents.
  3. Restrict local user permissions on systems where the Insight Agent is deployed to limit the ability to place or manipulate filesystem paths accessible to the agent process.
]]>highadvisoryprivilege-escalationvulnerabilityendpoint-security