CVE-2026-8666 — OS Command Injection in Rapid7 InsightConnect Traceroute Plugin

CVE-2026-8666

OS Command Injection in Rapid7 InsightConnect Traceroute Plugin PUBLISHED

Description (CNA)

OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insufficient input validation when constructing shell commands.

Affected (CNA)

Vendor / product	Versions
Rapid7 / InsightConnect Traceroute Plugin	affected 0 before 1.0.3; unaffected 1.0.3

CWE

CWE-78

References

https://extensions.rapid7.com/extension/traceroute

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.