Live › vulnerability › CVE-2026-115805
Rapid7 Insight Agent on Linux and macOS mishandles local filesystem paths during inventory collection. A logged-in local user can use a crafted path to gain elevated privileges on the machine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 17:26 UTC. All times on this page are UTC.
Hosts running the Rapid7 Insight Agent on Linux or macOS, where the Agent's inventory collection processes the crafted path. Exploitation requires an account or existing local access on the machine, so shared servers and multi-user workstations carry the most exposure. Systems without the Agent installed are not affected.
No product ranges from the sources yet.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local users to gain elevated privileges. Exploitation requires existing local access and depends on the Agent's inventory collection processing the crafted path.
This page as .md · .json · in your agent: get_signal("CVE-2026-115805")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.