CVE-2026-8666

Name of the Vulnerable Software and Affected Versions Rapid7 InsightConnect Traceroute Plugin on Linux (affected versions not specified)

Description An OS Command Injection issue exists in the traceroute action of the plugin. Remote attackers can execute arbitrary operating system commands due to insufficient input validation when constructing shell commands. The flaw is triggered via the following request parameters: host, port, max ttl, count, and time out.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.