Rapid7

Known Exploited Rapid7 Vulnerabilities

The following Rapid7 vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

By the Year

In 2026 there have been 42 vulnerabilities in Rapid7 with an average score of 6.9 out of ten. Last year, in 2025 Rapid7 had 4 security vulnerabilities published. That is, 38 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 2.16.

Recent Rapid7 Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-16895	Aug 27, 2026	Metasploit Framework JSONRPC Local Auth Bypass A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check (db.check) and the environment variable MSF_WS_JSON_RPC_API_TOKEN is not explicitly set, the application resets the internal state flag msf.auth_initialized to false. The ApiToken Warden authentication strategy misinterprets this false value as an indicator that authentication is not initialized or required, thereby granting unauthenticated local access to the JSON-RPC request dispatcher.	Metasploit
CVE-2026-19200	Aug 24, 2026	Velociraptor VQL verify() allows artifact overwrite via NOTEBOOK_EDIT The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions.  The attacker need only have the NOTEBOOK_EDIT permission (e.g. an analyst role) to be able to call this function.	Velociraptor
CVE-2026-15371	Aug 18, 2026	Velociraptor Web GUI Unrestricted URL Scheme Enables XSS Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.	Velociraptor
CVE-2026-18652	Aug 12, 2026	Velociraptor GUI: Stacked Result Sets Read from Denied Prefixes Velociraptor allows reading Stacked result sets from the GUI.  Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes. In particular, a user with read access to the root org can access result sets from child orgs.	Velociraptor
CVE-2026-64951	Aug 12, 2026	Velociraptor Var File DoS via ShouldPadFile Divide-by-Zero Panic A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process. The problem is a Divide by Zero bug in the ShouldPadFile() function.	Velociraptor
CVE-2026-64952	Aug 12, 2026	Velociraptor VQL hunt_delete() Allows Deletion without DELETE_RESULTS Permission The hunt_delete() VQL function allows deleting hunts.  Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "investigator" role) instead of the "DELETE_RESULTS" permission (usually only assigned to "administrators").	Velociraptor
CVE-2026-64955	Aug 12, 2026	Microsoft Excel CSV Exec via Cell Formula When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution.  Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not clear if the vulnerability is actually in Microsoft Excel treating a CSV data file as executable content, or if Velociraptor should be sanitizing the data to prevent Excel from executing it. However, since this is such a common use case for Velociraptor we decided to highlight it in an advisory.	Velociraptor
CVE-2026-64954	Aug 12, 2026	Velociraptor RBAC Escalation via VQL Auth Reset Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role.	Velociraptor
CVE-2026-18639	Aug 11, 2026	Velociraptor OIDC Email Claim Manipulation Enables Account Takeover When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email. This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.	Velociraptor
CVE-2026-18638	Aug 11, 2026	Authenticated Velociraptor User Can Terminate Server via SetPassword API Any authenticated Velociraptor user including one holding only the readerrole can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.	Velociraptor
CVE-2026-18640	Aug 11, 2026	NewNotebook API Auth Writes Outside Data Directory (CVE-2026-18640) The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files (such as ACL records, hunts etc). This can corrupt these files and cause data corruption.	Velociraptor
CVE-2026-18860	Aug 11, 2026	Velociraptor Org Deletion Priv Esc via ORG_ADMIN Check Mismatch Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORG_ADMIN permission on the ROOT org. This issue results from the Velociraptor server allowing for the deletion of Orgs by incorrectly checking the ORG_ADMIN permission of callers within the calling ORG instead of the ROOT org. However, Org admins of child orgs were able to add this permission to their ACL token within their own org. This allows an administrator in a child org, which is not also an administrator in the ROOT org, to delete other orgs.	Velociraptor
CVE-2026-17535	Aug 11, 2026	NTFS Parser Out-of-Bounds & Memory Exhaustion in Velociraptor Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typically Velociraptor's NTFS parser is used on live NTFS filesystems, limiting the opportunity of attackers corrupting the filesystem. However, in some applications (e.g.  dead disk forensics https://docs.velociraptor.app/docs/forensic/deaddisk/ ) Velociraptor may be used on untrusted NTFS image files.  If an attacker is able to inject maliciously corrupted NTFS Volumes they can cause a crash and a Denial of Service.	Velociraptor
CVE-2026-18636	Aug 11, 2026	VFSGetBuffer GRPC API Path Traversal in Velociraptor Allows Org Access Bypass The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to access usually denied files. If the user has read permission in the ROOT org, this allows access to other orgs, in which the user may not have permission.	Velociraptor
CVE-2026-18635	Aug 11, 2026	Velociraptor VQL Cross-Org Impersonation (<=0.77.2) Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller's org instead of against the target org. This allows an administrator in one org to impersonate another user in another org, in which they may not have the IMPERSONATE permission.	Velociraptor
CVE-2026-18972	Aug 11, 2026	CVE-2026-18972: Authenticated Identity Spoof via Grpc-Metadata-USER Header An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack from a user with low privileges to administrator.	Velociraptor
CVE-2026-18348	Aug 11, 2026	Velociraptor VQL Upload Plugins Missing Auth Check Enables Outbound Exfil Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance via port oracle and potential data exfiltration to external endpoints.	Velociraptor
CVE-2026-14172	Jul 24, 2026	Privilege Escalation via Unvalidated Exec in Rapid7 InsightVM Scan Engine 1.1.3935 Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.	Insightvm Nexpose Insight Agent And others...
CVE-2026-8661	Jun 26, 2026	SSRF & S2X in Rapid7 InsightConnect Markdown Plugin <=3.1.4 (markdown_to_pdf) Server-Side Request Forgery in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin on Linux in versions prior to 4.0.2 allows remote attackers to make arbitrary outbound HTTP requests via unsanitized resource-loading HTML elements (img/src, CSS url(), @import) embedded in Markdown input. The initial fix in 4.0.0 disabled JavaScript but did not neutralize resource-loading vectors. Resolved in 4.0.2 by sanitizing HTML with an allowlist of tags, attributes, and URL schemes.
CVE-2026-8658	Jun 25, 2026	OS Command Injection in Rapid7 InsightConnect TCPdump Plugin on Linux OS Command Injection vulnerability in Rapid7 InsightConnect Tcpdump Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the options or filter parameters due to insufficient input sanitization in shell command construction.
CVE-2026-8662	Jun 25, 2026	Rapid7 InsightConnect Compression Plugin Path Traversal in create_archive Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows authenticated attackers to write to unintended file paths via crafted filename input. The impact is limited to file corruption as content cannot be controlled by the attacker.
CVE-2026-8666	Jun 25, 2026	Rapid7 InsightConnect Traceroute Plugin: OS Command Injection via traceroute Action OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insufficient input validation when constructing shell commands.
CVE-2026-8592	Jun 25, 2026	Rapid7 InsightConnect AWK Plugin: Linux OS Command Injection via process_string OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to unsafe shell command construction in the processing pipeline.
CVE-2026-8664	Jun 25, 2026	OS Command Injection in Rapid7 InsightConnect Finger Plugin (Linux) OS Command Injection vulnerability in Rapid7 InsightConnect Finger Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the user or host parameters due to insufficient input validation in shell command construction.
CVE-2026-8665	Jun 25, 2026	OS Command Injection in Rapid7 InsightConnect Translate Plugin (Linux) OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to insufficient input sanitization in shell command construction.
CVE-2026-8660	Jun 25, 2026	OS Command Injection in Rapid7 InsightConnect Ping Plugin via host OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host parameter due to insufficient input validation when constructing shell commands.
CVE-2026-9153	Jun 25, 2026	Rapid7 InsightConnect Sed Plugin: Linux Arbitrary File Read via expr param Arbitrary File Read vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to read arbitrary files via the expression parameter due to insufficient input validation.
CVE-2026-9154	Jun 25, 2026	Rapid7 InsightConnect Sed Plugin Arbitrary File Write via expression parameter Arbitrary File Write vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to write attacker-controlled content to arbitrary file paths via the expression parameter.
CVE-2026-9155	Jun 25, 2026	InsightConnect Sed Plugin Command Injection Vulnerability OS Command Injection vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the expression parameter due to insufficient input validation.
CVE-2026-8659	Jun 25, 2026	CVE-2026-8659: OS Command Injection in Rapid7 InsightConnect SQLmap Plugin OS Command Injection vulnerability in Rapid7 InsightConnect SQLmap Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the api_host or api_port parameters during connection configuration due to insufficient input validation.
CVE-2026-8663	Jun 24, 2026	Rapid7 InsightConnect RPM Plugin OS Command Injection via repo/key/name OS Command Injection vulnerability in Rapid7 InsightConnect RPM Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the repo, key, or name parameters due to insufficient input sanitization in shell command construction.
CVE-2026-8795	Jun 09, 2026	YAML Injection in Rapid7 Velociraptor Windows Collectors <=0.76.6 A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostname field in client_info.json inside a collection ZIP is inserted into a YAML template via Go's text/template without escaping. An attacker providing a crafted collection ZIP can leverage literal double quotes and newlines in the hostname to break out of the YAML quoted string and inject a new mount remapping entry. When an analyst applies the generated remapping file with --remap, arbitrary VQL executes on their machine with NullACLManager (all permissions granted, unsandboxed).	Velociraptor
CVE-2026-7373	May 15, 2026	Metasploit Pro: LPE via OpenSSL Config in metasploitPostgreSQL Service Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing "vagrant" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to create it. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits the unprivileged vagrant user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.	Metasploit
CVE-2026-6863	May 06, 2026	Velociraptor <0.76.4: Cross-Org Auth Bypass in HTTP API (CVE-2026-6863) Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org. However, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.	Velociraptor
CVE-2026-6948	May 03, 2026	Velociraptor <=0.76.3: Agent Control Channel Resource Exhaustion OOM Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel. This allows a compromised or rogue Velociraptor client to crash the server via out-of-memory (OOM) by sending crafted messages through the normal client communication channel.	Velociraptor
CVE-2026-6482	Apr 17, 2026	Rapid7 Insight Agent LPE via crafted openssl.cnf (v>4.1.0.2) The Rapid7 Insight Agent (versions > 4.1.0.2) is vulnerable to a local privilege escalation attack that allows users to gain SYSTEM level control of a Windows host. Upon startup the agent service attempts to load an OpenSSL configuration file from a non-existent directory that is writable by standard users. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits an unprivileged user to bypass security controls and achieve a full host compromise under the agents SYSTEM level access.	Insight Agent
CVE-2026-6290	Apr 15, 2026	Velociraptor query() plugin data exposure before v0.76.3 Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are the same as the permissions they have in the org containing the notebook.	Velociraptor
CVE-2026-4482	Apr 10, 2026	Windows Rapid7 Insight Agent Unrestricted Permissions on Installer Certificate The installer certificate files in the /bootstrap/common/ssl folder do not seem to have restricted permissions on Windows systems (users have read and execute access). For the client.key file in particular, this could potentially lead to exploits, as this exposes agent identity material to any locally authenticated standard user.	Insight Agent
CVE-2026-5329	Apr 09, 2026	Rapid7 Velociraptor <0.76.2: Input Val Flaw in Monitoring Msg Handler Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring message handler on the Velociraptor server (primarily Linux) that allows an authenticated remote attacker to write to arbitrary internal server queues via a crafted monitoring message with a malicious queue name. The server handler that receives client monitoring messages does not sufficiently validate the queue name supplied by the client, allowing a rogue client to write arbitrary messages to privileged internal queues. This may lead to remote code execution on the Velociraptor server. Rapid7 Hosted Velociraptor instances are not affected by this vulnerability.	Velociraptor
CVE-2026-4837	Apr 08, 2026	Rapid7 Insight Agent eval() injection in Linux beaconing logic An eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve remote code execution as root via a crafted beacon response. Because the Agent uses mutual TLS (mTLS) to verify commands from the Rapid7 Platform, it is unlikely that the eval() function could be exploited remotely without prior, highly privileged access to the backend platform.	Insight Agent
CVE-2026-1568	Feb 03, 2026	Rapid7 InsightVM ACS Endpoint Signature Verification Bypass <8.34.0 Rapid7 InsightVM versions before 8.34.0 contain a signature verification issue on the Assertion Consumer Service (ACS) cloud endpoint that could allow an attacker to gain unauthorized access to InsightVM accounts setup via "Security Console" installations, resulting in full account takeover. The issue occurs due to the application processing these unsigned assertions and issuing session cookies that granted access to the targeted user accounts. This has been fixed in version 8.34.0 of InsightVM.	Insightvm
CVE-2026-1814	Feb 03, 2026	Rapid7 Nexpose <6.4.50: Weak RNG in CredentialsKeyStorePassword Rapid7 Nexpose versions 6.4.50 and later are vulnerable to an insufficient entropy issue in the CredentialsKeyStorePassword.generateRandomPassword() method. When updating legacy keystore passwords, the application generates a new password with insufficient length (7-12 characters) and a static prefix 'p', resulting in a weak keyspace. An attacker with access to the nsc.ks file can brute-force this password using consumer-grade hardware to decrypt stored credentials.	Nexpose
CVE-2025-14728	Dec 29, 2025	Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory. Velociraptor is normally only allowed to write in the datastore directory. The issue occurs due to insufficient sanitization of directory names which end with a ".", only encoding the final "." AS "%2E". Although files can be written to incorrect locations, the containing directory must end with "%2E". This limits the impact of this vulnerability, and prevents it from overwriting critical files.	Velociraptor
CVE-2025-11195	Sep 30, 2025	Rapid7 AppSpider Pro < 7.5.021 Project Name Validation Vulnerability Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in the configuration file to a name that already exists. This issue stems from a lack of effective verification of the uniqueness of project names when editing them outside the application in affected versions. This vulnerability was remediated in version 7.5.021 of the product.	Appspider Pro
CVE-2025-36857	Sep 25, 2025	Rapid7 Appspider Pro <7.5.021 Broken Access Control in Config Load Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, whereby an attacker can place files in directories belonging to other users or projects. Affected versions allow standard users to add custom configuration files. These files, which are loaded in alphabetical order, can override or change the settings of the original configuration files, creating a security vulnerability. This issue stems from improper directory access management. This vulnerability was remediated in version 7.5.021 of the product.	Appspider Pro
CVE-2025-6264	Jun 20, 2025	Velociraptor Artifact Perm Bypass Allows Arbitrary Cmd Exec Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions.  To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and update the configuration. This can lead to arbitrary command execution and endpoint takeover. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator' role).	Velociraptor
CVE-2024-10526	Nov 07, 2024	Velociraptor MSI Installer WRITE_DACL PrivEsc Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITE_DACL permission to the BUILTIN\\Users group. This allows local users who are not administrators to grant themselves the Full Control permission on Velociraptor's files. By modifying Velociraptor's files, local users can subvert the binary and cause the Velociraptor service to execute arbitrary code as the SYSTEM user, or to replace the Velociraptor binary completely.  This issue is fixed in version 0.73.3.	Velociraptor
CVE-2024-8042	Sep 09, 2024	Rapid7 Insight Platform: Missing Auth Enables Empty User Group Creation Rapid7 Insight Platform versions between November 2019 and August 14, 2024 suffer from missing authorization issues whereby an attacker can intercept local requests to set the name and description of a new user group. This could potentially lead to an empty user group being added to the incorrect customer. This vulnerability is remediated as of August 14, 2024.	Insight Platform
CVE-2024-6504	Jul 18, 2024	Rapid7 InsightVM Console DoS via REST Flood <6.6.260 Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can cause it to overload or crash by sending repeated invalid REST requests in a short timeframe, to the Console's port 443 causing the console to enter an exception handling logging loop, exhausting the CPU. There is no indication that an attacker can use this method to escalate privilege, acquire unauthorized access to data, or gain control of protected resources. This issue is fixed in version 6.6.261.	Insightvm
CVE-2024-2745	Apr 02, 2024	Rapid7 InsightVM Sensitive Info Leak in Login (Pre-6.6.244) Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is attempted before the page is fully loaded.  This vulnerability allows attackers to acquire sensitive information such as passwords, auth tokens, usernames etc.     The vulnerability is remediated in version 6.6.244.	Insightvm