EUVD-2026-39159
GHSA-p5pq-c6vw-g6xp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable SOAR plugin exploitable by any authenticated low-priv user (PR:L) with no interaction; command injection yields full host C/I/A impact.
Primary rating from Vendor (rapid7).
CVSS VectorNVD
Lifecycle Timeline
8DescriptionNVD
OS Command Injection vulnerability in Rapid7 InsightConnect Finger Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the user or host parameters due to insufficient input validation in shell command construction.
AnalysisAI
OS command injection in Rapid7's InsightConnect Finger Plugin (versions prior to 1.0.3) on Linux lets an authenticated attacker run arbitrary operating-system commands by injecting shell metacharacters into the user or host parameters, which are passed unsanitized into a constructed shell command (CWE-78). Because the plugin executes within the InsightConnect SOAR orchestrator, successful exploitation yields full read/write and availability impact on the host running the plugin. No public exploit is identified at time of analysis, and EPSS estimates only a 0.73% 30-day exploitation probability.
Technical ContextAI
The affected component is Rapid7 InsightConnect, a security orchestration, automation and response (SOAR) platform, specifically its Finger Plugin (cpe:2.3:a:rapid7:insightconnect_finger_plugin) which wraps the classic UNIX finger network user-information protocol. The vulnerability is a CWE-78 OS Command Injection: rather than passing the user and host arguments to the finger binary as a safe argument vector, the plugin builds a shell command string by concatenation, so shell metacharacters (semicolon, pipe, command substitution, backticks) in those parameters break out of the intended finger invocation and are interpreted by the underlying Linux shell. This is the canonical anti-pattern of invoking a command interpreter with attacker-influenced input instead of using parameterized exec calls.
RemediationAI
Upgrade the InsightConnect Finger Plugin to version 1.0.3 or later, the vendor-released fixed version per the Rapid7 extension listing (https://extensions.rapid7.com/extension/finger); a patch is available from the vendor. Until the plugin is updated, limit who can configure and execute the Finger Plugin by tightening InsightConnect role-based access so only trusted authenticated operators can supply the user and host parameters, and avoid wiring this plugin into workflows that accept externally-sourced or untrusted input for those fields (trade-off: this disrupts any automation that legitimately feeds dynamic host/user values). If the finger workflow is non-essential, disabling or removing the plugin entirely eliminates the exposure with minimal operational impact, since finger is rarely business-critical. Validate the fix against EUVD-2026-39159 / CVE-2026-8664.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today