Read the docs
TI-2026-05680 Aliases CVE-2026-6482GHSA-6rgm-mxx7-qxmc

Local Privilege Escalation via OpenSSL configuration file in Insight Agent

Priority LOW 38CWE-829Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-829.

Summary

The Rapid7 Insight Agent (versions > 4.1.0.2) is vulnerable to a local privilege escalation attack that allows users to gain SYSTEM level control of a Windows host. Upon startup the agent service attempts to load an OpenSSL configuration file from a non-existent directory that is writable by standard users. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits an unprivileged user to bypass security controls and achieve a full host compromise under the agent’s SYSTEM level access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0018 7th percentileScored 2026-11-07
Fix Fixed Insight Agent (Rapid7): 4.1.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Rapid7Insight Agentbefore 4.1.0.24.1.0.2Patch availableCNA
  • Insight Agent VendorRapid7 Affected before 4.1.0.2 Fixed in 4.1.0.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rapid7:insight_agent:*:*:*:*:*:*:*:*before 4.1.0.2VulnerableRapid7
  • cpe:2.3:a:rapid7:insight_agent:*:*:*:*:*:*:*:* Versions before 4.1.0.2 Vulnerable ·Rapid7

Remediation

  • Fix · CNA Insight Agent (Rapid7) Fixed in 4.1.0.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-6482
  2. 2026-10-03 Alias added: GHSA-6rgm-mxx7-qxmc

References

Other 1

  • TI-2023-02132 Rapid7 Insight Agent Directory Traversal CVSS 3.1HIGH 7.5
  • TI-2019-03993 Uncontrolled search path in Rapid7 Insight Agent CVSS 3.1HIGH 7.8
  • TI-2022-00173 Rapid7 Insight Agent Privilege Escalation CVSS 3.1HIGH 7.8
  • TI-2026-04220 Eval Injection in Rapid7 Insight Agent CVSS 3.1HIGH 7.2
  • TI-2021-02901 Rapid7 Insight Agent Privilege Escalation CVSS 3.1HIGH 7.8
  • TI-2026-03892 Insight Agent Private Key Information Disclosure via Inherited File Permissions CVSS 4.0MEDIUM 6.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences