CVE-2026-115805

Full vulnerability record from the local CVENow database.

Description

Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local users to gain elevated privileges. Exploitation requires existing local access and depends on the Agent's inventory collection processing the crafted path.

Severity

HIGH

CVSS score

7.8 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-10-29 17:18:01.840000

Last modified

2026-10-30 04:18:18.673000

View original CVE JSON

{
  "id": "CVE-2026-115805",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-29T17:18:01.840",
  "lastModified": "2026-10-30T04:18:18.673",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local users to gain elevated privileges. Exploitation requires existing local access and depends on the Agent's inventory collection processing the crafted path."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Rapid7",
          "product": "Insight Agent",
          "defaultStatus": "unaffected",
          "platforms": [
            "MacOS",
            "Linux"
          ],
          "versions": [
            {
              "version": "0",
              "lessThan": "4.1.4.43",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-29T00:00:00+00:00",
          "id": "CVE-2026-115805",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://docs.rapid7.com/insight/release-notes-2026-october/#rapid7-agent-insight-agent",
      "source": "[email protected]"
    }
  ]
}