← Database

CVE-2026-8666

HIGH CVSS: 7.7 Published: 2026-06-25 Modified: 2026-06-29

Description

OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insufficient input validation when constructing shell commands.

Affected Platforms

Linux Linux KernelRapid7 Insightconnect Traceroute

Weakness Type

CWE-78

References