CVE-2026-4482

MEDIUM

Insight Agent Private Key Information Disclosure via Inherited File Permissions

Title source: cna

Description

The installer certificate files in the …/bootstrap/common/ssl folder do not seem to have restricted permissions on Windows systems (users have read and execute access). For the client.key file in particular, this could potentially lead to exploits, as this exposes agent identity material to any locally authenticated standard user.

References (1)

Core 1

Core References

https://docs.rapid7.com/insight/release-notes-2026-april/#improvements-and-fixes

Scores

CVSS v3 5.5

EPSS 0.0008

EPSS Percentile 0.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-732

Status published

Products (2)

Rapid7/Insight Agent < 4.1.0.2

rapid7/insight_agent < 4.1.0.2

Published Apr 10, 2026

Tracked Since Apr 10, 2026