← volver
CVE-2026-4482

Insight Agent Private Key Information Disclosure via Inherited File Permissions

CVSS 6.8 MEDIUMEPSS 0.1%CWE-732
Vexday Risk Score
13Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 6.8EPSS 0.1%KEV nãoPoC Nuclei Metasploit Patch
Ciclo de vida
10 abr 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
The installer certificate files in the …/bootstrap/common/ssl folder do not seem to have restricted permissions on Windows systems (users have read and execute access). For the client.key file in particular, this could potentially lead to exploits, as this exposes agent identity material to any locally authenticated standard user.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:L
Productos afectados
Rapid7 · Insight Agent

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →