High severity · published Oct 29, 2026
CVE-2026-115805
Rapid7 Insight Agent Local Privilege Escalation via Shell Injection in mcp.json Configuration Path
New
7.8
CVSS
–
EPSS
No
On KEV
Description
Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local users to gain elevated privileges. Exploitation requires existing local access and depends on the Agent's inventory collection processing the crafted path.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IA
Insight Agent · Rapid7
before 4.1.4.43 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115805
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115805
docs.rapid7.com
https://docs.rapid7.com/insight/release-notes-2026-october/#rapid7-agent-insight-agent
More from Insight Agent
7.8
CVE-2026-89325
Rapid7 Insight Agent: Uncontrolled search path element in InsightVM assessment content leads to local privilege escalation
7.8
CVE-2026-14172
Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation
7.8
CVE-2026-6482
Local Privilege Escalation via OpenSSL configuration file in Insight Agent
7.8
CVE-2022-0237
Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted…
7.8
CVE-2021-4007
Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path