CVE-2026-8664

MEDIUM

OS Command Injection in Rapid7 InsightConnect Finger Plugin

Title source: cna

Description

OS Command Injection vulnerability in Rapid7 InsightConnect Finger Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the user or host parameters due to insufficient input validation in shell command construction.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://extensions.rapid7.com/extension/finger

Scores

CVSS v3 6.0

EPSS 0.0083

EPSS Percentile 54.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-78

Status published

Products (3)

Rapid7/InsightConnect Finger Plugin < 1.0.3

Rapid7/InsightConnect Finger Plugin 1.0.3

rapid7/insightconnect_finger < 1.0.3

Published Jun 25, 2026

Tracked Since Jun 25, 2026