{"id":"CVE-2026-115805","kind":"vulnerability","aliases":["CVE-2026-115805"],"related":[],"title":"Rapid7 Insight Agent: local path handling lets a local user gain root","description":"Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local users to gain elevated privileges. Exploitation requires existing local access and depends on the Agent's inventory collection processing the crafted path.","summary":"Rapid7 Insight Agent on Linux and macOS mishandles local filesystem paths during inventory collection. A logged-in local user can use a crafted path to gain elevated privileges on the machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","insight-agent","linux","macos","rapid7"],"not_affected_if":["agent-not-installed","no-local-users","windows-only"],"how_to_check":"- Check whether the Insight Agent is installed on Linux or macOS hosts (paths are unverified; Rapid7 names none).\n- Rapid7 has not published an affected or fixed version for this CVE yet. Watch Rapid7's Insight Agent release notes and the CVE page, then compare your installed version.","fix":null,"status":"open","published_at":"2026-10-29T17:18:01+00:00","first_seen_at":"2026-10-29T17:26:17+00:00","triaged_at":"2026-10-29T17:27:48+00:00","updated_at":"2026-10-29T17:29:25+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-29T17:27:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Rapid7 Insight Agent: local path handling lets a local user gain root","impact":"high","summary":"Rapid7 Insight Agent on Linux and macOS mishandles local filesystem paths during inventory collection. A logged-in local user can use a crafted path to gain elevated privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["rapid7","insight-agent","linux","macos"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges, possibly root, on the host","analyst_note":"Find the Rapid7 advisory for CVE-2026-115805 to get the fixed Insight Agent version and the exact affected Linux and macOS ranges.","how_to_check":"- Check whether the Insight Agent is installed on Linux or macOS hosts, for example with `ls /opt/rapid7/ir_agent` on Linux or the Rapid7 entry in /Applications on macOS (paths are unverified, the sources do not name them).\n- Compare the installed Agent version with the fixed version from Rapid7's advisory (unknown from the sources).","plain_action":"","needs_analyst":true,"not_affected_if":["agent-not-installed","windows-only","no-local-users"],"who_is_affected":"Hosts running the Rapid7 Insight Agent on Linux or macOS, where the Agent's inventory collection processes the crafted path. Exploitation requires an account or existing local access on the machine, so shared servers and multi-user workstations carry the most exposure. Systems without the Agent installed are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000718,"input_tokens":4116,"output_tokens":613,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Rapid7 advisory for CVE-2026-115805 to get the fixed Insight Agent version and the exact affected Linux and macOS ranges.","search":"'-115805':15A,18A '-2026':14A,17A 'access':85C 'agent':3A,22B,28B,67C,90C 'allow':73C 'authent':74C 'collect':39B,93C 'craft':49B,96C 'cve':13A,16A 'depend':87C 'elev':53B,79C 'exist':83C 'exploit':81C 'filesystem':35B,62C 'gain':11A,52B,78C 'handl':6A,59C 'improp':58C 'infrastructur':19B 'insight':2A,21B,27B,66C 'insight-ag':20B 'inventori':38B,92C 'let':7A 'linux':23B,30B,69C 'local':4A,9A,34B,44B,61C,75C,84C 'log':42B 'logged-in':41B 'machin':57B 'maco':24B,32B,71C 'may':72C 'mishandl':33B 'path':5A,36B,50B,63C,97C 'privileg':54B,80C 'process':94C 'rapid7':1A,25B,26B,65C 'requir':82C 'root':12A 'use':47B 'user':10A,45B,76C","nicknames":[],"mitigations":[],"who_affected":"Hosts running the Rapid7 Insight Agent on Linux or macOS, where the Agent's inventory collection processes the crafted path. Exploitation requires an account or existing local access on the machine, so shared servers and multi-user workstations carry the most exposure. Systems without the Agent installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T17:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@rapid7.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115805","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115805","severity":null,"published_at":"2026-10-29T17:18:01+00:00","modified_at":"2026-10-29T17:18:01+00:00","first_seen_at":"2026-10-29T17:26:17+00:00","fetched_at":"2026-10-29T17:26:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115805:1086","url":null,"severity":null,"published_at":"2026-10-29T17:29:25+00:00","modified_at":"2026-10-29T17:29:25+00:00","first_seen_at":"2026-10-29T17:29:25+00:00","fetched_at":"2026-10-29T17:29:25+00:00","note":"Rapid7's DB page (linked) confirms description, CVSS 7.8, not KEV, but lists no affected or fixed versions and no vendor advisory yet. Fix unknown; recheck docs.rapid7.com Insight Agent release notes. Not marking anything verified. Sibling CVE-2026-14172 (content component 0.0.245.0) is a different issue."}],"documents":[{"id":18240,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-115805/","title":"Rapid7 DB: CVE-2026-115805","kind":"advisory","source":"analyst","publisher":null,"text":"Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local users to gain elevated privileges. Exploitation requires existing local access and depends on the Agent's inventory collection processing the crafted path. CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Not in CISA KEV. Published Oct 29 2026. No affected or fixed versions listed on the page.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}