InsightConnect Sed Plugin CVE-2026-9154

Exploitation requires authenticated, low-privileged access to the Rapid7 InsightConnect platform (CVSS PR:L) and the ability to invoke the Sed plugin and control its 'expression' parameter - that parameter is the exact injection point used to specify the traversal/output path. The deployment must be running the InsightConnect Sed Plugin on Linux. Limiting factors: the attacker must already be authenticated to InsightConnect (not anonymous), so the realistic threat is an insider or a previously-compromised low-privilege account; no user interaction by a victim is needed, and attack complexity is low once that access exists. Impact is bounded by the filesystem permissions of the plugin's runtime process.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) describes a network-reachable, low-complexity attack requiring low privileges and no user interaction, with high integrity impact, low availability impact, and no confidentiality impact - consistent with an arbitrary file write rather than direct data disclosure. There is no EPSS score, KEV listing, or POC provided in the input, so exploitation is currently theoretical: no public exploit identified at time of analysis and not confirmed actively exploited. The PR:L requirement is the main limiter - an attacker must already hold authenticated access to the InsightConnect environment (e.g., a workflow/plugin user), which narrows the realistic threat to insiders or attackers who have already gained a foothold. This is a meaningful-but-not-emergency priority: high integrity impact from a write primitive can escalate to code execution, but the authentication gate and absence of any exploitation signal keep it below drop-everything urgency. Note the CVSS marks AV:N while a plugin invocation may in practice be driven through the orchestrator rather than direct internet exposure - verify the actual reachability of the plugin endpoint in your deployment.

An attacker with low-privileged authenticated access to the InsightConnect platform configures or triggers a Sed plugin action and supplies an expression parameter containing path-traversal sequences pointing outside the intended output directory. Because attack complexity is low and no user interaction is required, the plugin writes attacker-controlled content to a sensitive location (for example a script, cron, or configuration file), which can then be leveraged toward code execution. No public proof-of-concept is identified at time of analysis.