High severity7.7NVD Advisory· Published Jun 25, 2026· Updated Jun 29, 2026

CVE-2026-8666

Description

OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insufficient input validation when constructing shell commands.

Affected products

Rapid7/Insightconnect Traceroute
cpe:2.3:a:rapid7:insightconnect_traceroute:*:*:*:*:*:rapid7:*:*
Range: <1.0.3
Rapid7/InsightConnect Sed Pluginllm-fuzzy

Patches

Vulnerability mechanics

References

extensions.rapid7.com/extension/traceroutenvdProduct

News mentions

No linked articles in our index yet.

cvss	0.501
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000