Rapid7 Vulnerabilities and Affected Products
Explore source-attributed vulnerabilities associated with Rapid7 products.
Products
- Velociraptor32 vulnerabilities
- Nexpose17 vulnerabilities
- Insight Agent10 vulnerabilities
- InsightVM9 vulnerabilities
- AppSpider Pro6 vulnerabilities
- Metasploit Framework6 vulnerabilities
- Metasploit Pro6 vulnerabilities
- Metasploit4 vulnerabilities
- InsightCloudSec3 vulnerabilities
- InsightConnect Sed Plugin3 vulnerabilities
- AppSpider2 vulnerabilities
- Insight Platform2 vulnerabilities
- Insight Collector1 vulnerability
- InsightAppSec1 vulnerability
- InsightConnect AWK Plugin1 vulnerability
- InsightConnect Compression Plugin1 vulnerability
- InsightConnect Finger Plugin1 vulnerability
- InsightConnect Markdown Plugin1 vulnerability
- InsightConnect Ping Plugin1 vulnerability
- InsightConnect RPM Plugin1 vulnerability
- InsightConnect SQLmap Plugin1 vulnerability
- InsightConnect Tcpdump Plugin1 vulnerability
- InsightConnect TR Plugin1 vulnerability
- InsightConnect Traceroute Plugin1 vulnerability
- InsightVM Virtual Appliance1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-18652MEDIUM | Velociraptor STACK Type Download Path Bypasses Denied Prefix CheckVelociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes. In particular, a user with read access to the root org can access result sets from child orgs. CWE-862Aug 12, 2026 | CVSS4.9v3.1 | EPSS0.222% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Velociraptor DoS triggered by Divide by Zero panicA rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process. The problem is a Divide by Zero bug in the ShouldPadFile() function. CWE-369Aug 12, 2026 | CVSS3.5v3.1 | EPSS0.163% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-64952MEDIUM | Velociraptor Hunt Deletion With Insufficient Permission CheckThe hunt_delete() VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "investigator" role) instead of the "DELETE_RESULTS" permission (usually only assigned to "administrators"). CWE-863Aug 12, 2026 | CVSS6.5v3.1 | EPSS0.174% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-64955MEDIUM | Velociraptor CSV Formula Injection in Export PipelineWhen Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not clear if the vulnerability is actually in Microsoft Excel treating a CSV data file as executable content, or if Velociraptor should be sanitizing the data to prevent Excel from executing it. However, si… CWE-1236Aug 12, 2026 | CVSS6.1v3.1 | EPSS0.224% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-64954HIGH | Velociraptor collect_client() Permissions BypassVelociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role. CWE-862Aug 12, 2026 | CVSS8.2v3.1 | EPSS0.232% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-18639HIGH | Velociraptor OIDC Authenticator susceptible to email spoofingWhen Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email. This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover. CWE-290Aug 11, 2026 | CVSS7.3v3.1 | EPSS0.263% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-18638MEDIUM | Velociraptor server crash via the SetPassword APIAny authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist. | CVSS6.5v3.1 | EPSS0.289% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-18640HIGH | Velociraptor directory traversal via the NewNotebook APIThe NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files (such as ACL records, hunts etc). This can corrupt these files and cause data corruption. CWE-22Aug 11, 2026 | CVSS7.1v3.1 | EPSS0.313% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-18860HIGH | Velociraptor incorrect Org deletion permissions checkVelociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORG_ADMIN permission on the ROOT org. This issue results from the Velociraptor server allowing for the deletion of Orgs by incorrectly checking the ORG_ADMIN permission of callers within the calling ORG instead of th… CWE-280Aug 11, 2026 | CVSS8.7v3.1 | EPSS0.304% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-17535MEDIUM | Velociraptor Multiple Crashes in NTFS Parser when applied to invalid NTFS VolumesVelociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typically Velociraptor's NTFS parser is used on live NTFS filesystems, limiting the opportunity of attackers corrupting the filesystem. However, in some applications (e.g. dead disk forensics https://docs.velociraptor.app/docs/forensic/deaddisk/ ) Velociraptor may be used on untrusted NTFS image files. If an attacker is able to inject malic… | CVSS6.2v3.1 | EPSS0.118% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-18636MEDIUM | Velociraptor VFSGetBuffer API path deny list bypassThe Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to access usually denied files. If the user has read permission in the ROOT org, this allows access to other orgs, in which the user may not have permission. CWE-288Aug 11, 2026 | CVSS6.8v3.1 | EPSS0.236% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-18635HIGH | Velociraptor query plugin allows impersonation in other orgsVelociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller's org instead of against the target org. This allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE per… CWE-863Aug 11, 2026 | CVSS7.2v3.1 | EPSS0.257% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-18972CRITICAL | Velociraptor authenticated identity-spoofing vulnerabilityAn authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack from a user with low privileges to administrator. CWE-290Aug 11, 2026 | CVSS9.6v3.1 | EPSS0.325% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-18348MEDIUM | Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL pluginsMissing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints. CWE-863Aug 11, 2026 | CVSS4.1v3.1 | EPSS0.246% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-14172HIGH | Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable InvocationRapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0. CWE-250Jul 24, 2026 | CVSS7.8v3.1 | EPSS0.107% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-8661MEDIUM | Server-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF PluginServer-Side Request Forgery in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin on Linux in versions prior to 4.0.2 allows remote attackers to make arbitrary outbound HTTP requests via unsanitized resource-loading HTML elements (img/src, CSS url(), @import) embedded in Markdown input. The initial fix in 4.0.0 disabled JavaScript but did not neutralize resource-loading vectors. Resolved in 4.0.2 by sanitizing HTML with an allowlist of tags, attributes, and URL schemes. | CVSS4.8v3.1 | EPSS0.245% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-8658MEDIUM | OS Command Injection in Rapid7 InsightConnect Tcpdump PluginOS Command Injection vulnerability in Rapid7 InsightConnect Tcpdump Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the options or filter parameters due to insufficient input sanitization in shell command construction. CWE-78Jun 25, 2026 | CVSS6.0v3.1 | EPSS0.833% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Path Traversal in Rapid7 InsightConnect Compression PluginPath Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows authenticated attackers to write to unintended file paths via crafted filename input. The impact is limited to file corruption as content cannot be controlled by the attacker. CWE-22Jun 25, 2026 | CVSS3.3v3.1 | EPSS0.216% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-8666HIGH | OS Command Injection in Rapid7 InsightConnect Traceroute PluginOS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insufficient input validation when constructing shell commands. CWE-78Jun 25, 2026 | CVSS7.7v3.1 | EPSS0.675% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-8592HIGH | OS Command Injection in Rapid7 InsightConnect AWK PluginOS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to unsafe shell command construction in the processing pipeline. CWE-78Jun 25, 2026 | CVSS7.7v3.1 | EPSS0.675% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-8664MEDIUM | OS Command Injection in Rapid7 InsightConnect Finger PluginOS Command Injection vulnerability in Rapid7 InsightConnect Finger Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the user or host parameters due to insufficient input validation in shell command construction. CWE-78Jun 25, 2026 | CVSS6.0v3.1 | EPSS0.833% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-8665HIGH | OS Command Injection in Rapid7 InsightConnect Translate PluginOS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to insufficient input sanitization in shell command construction. CWE-78Jun 25, 2026 | CVSS7.7v3.1 | EPSS0.675% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-8660HIGH | OS Command Injection in Rapid7 InsightConnect Ping PluginOS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host parameter due to insufficient input validation when constructing shell commands. CWE-78Jun 25, 2026 | CVSS7.7v3.1 | EPSS0.675% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-9153MEDIUM | Arbitrary File Read in Rapid7 InsightConnect Sed PluginArbitrary File Read vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to read arbitrary files via the expression parameter due to insufficient input validation. | CVSS6.5v3.1 | EPSS0.308% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-9154HIGH | Arbitrary File Write in Rapid7 InsightConnect Sed PluginArbitrary File Write vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to write attacker-controlled content to arbitrary file paths via the expression parameter. CWE-22Jun 25, 2026 | CVSS7.1v3.1 | EPSS0.275% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |