CVE-2026-8666: OS Command Injection in Rapid7 InsightConnect Traceroute Plugin
OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, maxttl, count, or timeout request parameters due to insufficient input validation when constructing shell commands.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8666?
CVE-2026-8666 has a high severity rating of 7.7.
How do I fix CVE-2026-8666?
To mitigate CVE-2026-8666, ensure that input validation is properly implemented in the traceroute action of Rapid7 InsightConnect Traceroute Plugin.
What types of attacks are possible with CVE-2026-8666?
CVE-2026-8666 allows remote attackers to execute arbitrary OS commands due to insufficient input validation.
Which software is affected by CVE-2026-8666?
The vulnerability CVE-2026-8666 affects the Rapid7 InsightConnect Traceroute Plugin on Linux.
What causes the CVE-2026-8666 vulnerability?
CVE-2026-8666 is caused by inadequate input validation when handling parameters such as host, port, max_ttl, count, or time_out.