---
id: "CVE-2026-115805"
kind: "vulnerability"
aliases: ["CVE-2026-115805"]
title: "Rapid7 Insight Agent: local path handling lets a local user gain root"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "insight-agent", "linux", "macos", "rapid7"]
not_affected_if: ["agent-not-installed", "no-local-users", "windows-only"]
published_at: "2026-10-29T17:18:01+00:00"
first_seen_at: "2026-10-29T17:26:17+00:00"
updated_at: "2026-10-29T17:29:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115805", "first_seen_at": "2026-10-29T17:26:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T17:29:25+00:00"}]
---

# Rapid7 Insight Agent: local path handling lets a local user gain root

Rapid7 Insight Agent on Linux and macOS mishandles local filesystem paths during inventory collection. A logged-in local user can use a crafted path to gain elevated privileges on the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Insight Agent is installed on Linux or macOS hosts (paths are unverified; Rapid7 names none).
- Rapid7 has not published an affected or fixed version for this CVE yet. Watch Rapid7's Insight Agent release notes and the CVE page, then compare your installed version.

## Timeline

- 2026-10-29T17:26:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115805
- 2026-10-29T17:29:25+00:00 analyst — Rapid7's DB page (linked) confirms description, CVSS 7.8, not KEV, but lists no affected or fixed versions and no vendor advisory yet. Fix unknown; recheck docs.rapid7.com Insight Agent release notes. Not marking anything verified. Sibling CVE-2026-14172 (content component 0.0.245.0) is a different issue.

## Documents

- [advisory] Rapid7 DB: CVE-2026-115805 https://www.rapid7.com/db/vulnerabilities/cve-2026-115805/

## From the sources

Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local users to gain elevated privileges. Exploitation requires existing local access and depends on the Agent's inventory collection processing the crafted path.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_