What is the CVSS score of EUVD-2026-39152?

EUVD-2026-39152 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of InsightConnect SQLmap Plugin are affected by EUVD-2026-39152?

Rapid7's InsightConnect SQLmap Plugin (versions before 2.0.1) contains an OS command injection vulnerability that allows authenticated users to execute arbitrary code within the InsightConnect…. A patch is available.

InsightConnect SQLmap Plugin EUVD-2026-39152

Q: How to fix or mitigate EUVD-2026-39152?

Within 24 hours: Inventory all InsightConnect deployments using SQLmap Plugin and identify authenticated user accounts with plugin configuration privileges. Within 7 days: Upgrade the InsightConnect SQLmap Plugin to version 2.0.1 or later on all affected instances. Within 30 days: Conduct access reviews for InsightConnect plugin configuration roles and implement audit logging for plugin configuration changes.

| CVE-2026-8659 HIGH

OS Command Injection (CWE-78)

2026-06-25 rapid7

GHSA-frqr-h5vc-vr89

Command Injection Insightconnect Sqlmap Plugin Rapid7

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (rapid7) PRIMARY

MEDIUM

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable config interface and low complexity, but requires an authenticated user with connection-config rights (PR:L); OS command execution yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (rapid7).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 29, 2026 - 19:53 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 29, 2026 - 19:37 vuln.today

cvss_changed

Severity Changed

Jun 29, 2026 - 19:37 NVD

MEDIUM HIGH

CVSS changed

Jun 29, 2026 - 19:37 NVD

6.0 (MEDIUM) 8.8 (HIGH)

Patch available

Jun 25, 2026 - 02:01 EUVD

Analysis Generated

Jun 25, 2026 - 00:29 vuln.today

CVE Published

Jun 25, 2026 - 00:07 cve.org

MEDIUM 6.0

DescriptionNVD

OS Command Injection vulnerability in Rapid7 InsightConnect SQLmap Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the api_host or api_port parameters during connection configuration due to insufficient input validation.

AnalysisAI

OS command injection in Rapid7's InsightConnect SQLmap Plugin (versions before 2.0.1) on Linux lets an authenticated InsightConnect user inject arbitrary operating-system commands through the api_host or api_port fields supplied while configuring the plugin's connection. Because the plugin runs inside the InsightConnect orchestration runtime, a successful injection yields code execution in that automation context (CVSS 8.8, CWE-78). No public exploit identified at time of analysis, and SSVC records exploitation status as none; EPSS is modest at 0.73% (50th percentile).

Technical ContextAI

InsightConnect is Rapid7's SOAR (security orchestration, automation and response) platform, and the SQLmap Plugin is an extension that wraps the open-source sqlmap SQL-injection testing tool so it can be driven inside automation workflows. The CPE cpe:2.3:a:rapid7:insightconnect_sqlmap_plugin confirms the single affected component. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): connection-configuration inputs (api_host, api_port) are passed toward an OS command without sufficient validation or sanitization, so shell metacharacters embedded in those values are interpreted by the underlying Linux shell rather than treated as literal data. This pattern typically arises when a plugin builds the sqlmap invocation (or related shell call) by string concatenation of user-controlled parameters.

RemediationAI

Vendor-released patch: upgrade the InsightConnect SQLmap Plugin to version 2.0.1 or later, obtained from the Rapid7 extensions marketplace (https://extensions.rapid7.com/extension/sqlmap); since plugins execute in the orchestrator runtime, update the plugin version used by your jobs and re-validate workflows that reference it. Until patched, the most effective compensating control is to restrict who can create or edit SQLmap plugin connections by tightening InsightConnect role-based access so only fully trusted administrators hold connection-configuration rights (trade-off: may slow workflow authoring for analysts); additionally, constrain or template the api_host/api_port values to known-good hosts and numeric ports, and avoid exposing connection editing to lower-trust users. Monitor orchestrator hosts for unexpected child processes spawned from the plugin runtime as a detection backstop.