CVE-2026-9153: Arbitrary File Read in Rapid7 InsightConnect…

Record summary

CVE-2026-9153 has a selected CVSS score of 6.5 (medium).

Description

Arbitrary File Read vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to read arbitrary files via the expression parameter due to insufficient input validation.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone

AutomatableNo

Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 25, 2026 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
InsightConnect Sed Plugin Browse Rapid7 / InsightConnect Sed Plugin Default status: unaffected	CVE List	Before 2.0.5	affected
	CVE List	2.0.5	unaffected

References

extensions.rapid7.comVendor advisory

https://extensions.rapid7.com/extension/sed

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2026-9153