CVE-2026-8658

MEDIUM

OS Command Injection in Rapid7 InsightConnect Tcpdump Plugin

Title source: cna

Description

OS Command Injection vulnerability in Rapid7 InsightConnect Tcpdump Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the options or filter parameters due to insufficient input sanitization in shell command construction.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://extensions.rapid7.com/extension/tcpdump

Scores

CVSS v3 6.0

EPSS 0.0083

EPSS Percentile 54.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-78

Status published

Products (3)

Rapid7/InsightConnect Tcpdump Plugin < 2.0.0

Rapid7/InsightConnect Tcpdump Plugin 2.0.0

rapid7/insightconnect_tcpdump < 2.0.0

Published Jun 25, 2026

Tracked Since Jun 25, 2026