InsightConnect Sed Plugin CVE-2026-9153

Exploitation requires a valid, authenticated InsightConnect session with at least low-privilege access to invoke the Sed Plugin, consistent with the CVSS PR:L metric. The attacker must be able to submit a crafted value in the plugin's expression parameter - this occurs through the InsightConnect workflow interface over a network connection (AV:N). The vulnerability is limited to Linux deployments of the host running InsightConnect with the Sed Plugin installed. Unauthenticated external attackers cannot exploit this flaw directly. Scope is unchanged (S:U), meaning impact is confined to files accessible on the InsightConnect Linux host. Exploitation is limited by the requirement for valid credentials or an active authenticated session, and by the absence of integrity or availability impact - the attacker can read files but cannot write or cause disruption through this vector alone.

The NVD CVSS 3.1 score of 6.5 (Medium) accurately characterizes the threat envelope: network-accessible (AV:N), low complexity (AC:L), low-privilege authentication required (PR:L), no user interaction (UI:N), no scope change (S:U), and high confidentiality impact (C:H) with no integrity or availability impact. Real-world risk is meaningfully constrained by the authentication prerequisite - unauthenticated external actors cannot exploit this directly, and it represents a post-authentication privilege escalation of read access rather than an initial compromise vector. No EPSS probability data was provided, and the absence of both a KEV listing and public POC suggests this is not under active mass exploitation. However, within an authenticated attacker's session, path traversal requires minimal skill and is highly reliable, making lateral movement to credential files or secrets a realistic post-exploitation step. The wildcard CPE version is a notable signal that Rapid7 has not yet scoped a safe version boundary.

An authenticated InsightConnect user with Sed Plugin access constructs a workflow action passing a crafted expression parameter containing a path traversal sequence targeting a sensitive Linux file (e.g., a value resolving to /etc/shadow or a private key under /root/.ssh/). The plugin passes the unsanitized value to the underlying file-reading operation, which returns the file contents within the workflow execution result. No public POC has been identified, but the technique directly mirrors canonical CWE-22 exploitation patterns that require no specialized tooling.