CVE-2026-4837

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4837", "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "state": "PUBLISHED", "assignerShortName": "rapid7", "dateReserved": "2026-03-25T14:28:27.182Z", "datePublished": "2026-04-08T15:59:03.121Z", "dateUpdated": "2026-04-13T13:04:16.829Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7", "dateUpdated": "2026-04-08T16:08:02.464Z"}, "title": "Eval Injection in Rapid7 Insight Agent", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-95", "description": "CWE-95 Improper neutralization of directives in dynamically evaluated code ('eval injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "affected": [{"vendor": "Rapid7", "product": "Insight Agent", "platforms": ["Linux"], "modules": ["ir_agent"], "versions": [{"status": "affected", "version": "0", "lessThan": "4.1.0.2", "changes": [{"at": "4.1.0.2", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve remote code execution as root via a crafted beacon response. Because the Agent uses mutual TLS (mTLS) to verify commands from the Rapid7 Platform, it is unlikely that the eval() function could be exploited remotely without prior, highly privileged access to the backend platform.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve remote code execution as root via a crafted beacon response. Because the Agent uses mutual TLS (mTLS) to verify commands from the Rapid7 Platform, it is unlikely that the eval() function could be exploited remotely without prior, highly privileged access to the backend platform."}]}], "references": [{"url": "https://docs.rapid7.com/insight/release-notes-2026-april/#improvements-and-fixes"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.6, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "John Rodriguez", "type": "reporter"}, {"lang": "en", "value": "Cyberdagger", "type": "sponsor"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4837", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-09T03:56:13.769975Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T13:04:16.829Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4837", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-09T03:56:13.769975Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T13:00:30.385Z"}}], "cna": {"title": "Eval Injection in Rapid7 Insight Agent", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "John Rodriguez"}, {"lang": "en", "type": "sponsor", "value": "Cyberdagger"}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Rapid7", "modules": ["ir_agent"], "product": "Insight Agent", "versions": [{"status": "affected", "changes": [{"at": "4.1.0.2", "status": "unaffected"}], "version": "0", "lessThan": "4.1.0.2", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://docs.rapid7.com/insight/release-notes-2026-april/#improvements-and-fixes"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "An eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve remote code execution as root via a crafted beacon response. Because the Agent uses mutual TLS (mTLS) to verify commands from the Rapid7 Platform, it is unlikely that the eval() function could be exploited remotely without prior, highly privileged access to the backend platform.", "supportingMedia": [{"type": "text/html", "value": "An eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve remote code execution as root via a crafted beacon response. Because the Agent uses mutual TLS (mTLS) to verify commands from the Rapid7 Platform, it is unlikely that the eval() function could be exploited remotely without prior, highly privileged access to the backend platform.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-95", "description": "CWE-95 Improper neutralization of directives in dynamically evaluated code ('eval injection')"}]}], "providerMetadata": {"orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7", "dateUpdated": "2026-04-08T16:08:02.464Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4837", "state": "PUBLISHED", "dateUpdated": "2026-04-13T13:04:16.829Z", "dateReserved": "2026-03-25T14:28:27.182Z", "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "datePublished": "2026-04-08T15:59:03.121Z", "assignerShortName": "rapid7"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["ir_agent"], "platforms": ["Linux"], "product": "Insight Agent", "vendor": "Rapid7", "versions": [{"changes": [{"at": "4.1.0.2", "status": "unaffected"}], "lessThan": "4.1.0.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cve@rapid7.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rapid7:insight_agent:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB08C3C5-FAC4-4999-A869-E5F3992DA2C5", "versionEndExcluding": "4.1.0.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve remote code execution as root via a crafted beacon response. Because the Agent uses mutual TLS (mTLS) to verify commands from the Rapid7 Platform, it is unlikely that the eval() function could be exploited remotely without prior, highly privileged access to the backend platform."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n eval() en la l\u00f3gica de balizamiento del Agente Rapid7 Insight para versiones de Linux podr\u00eda te\u00f3ricamente permitir a un atacante lograr ejecuci\u00f3n remota de c\u00f3digo como root a trav\u00e9s de una respuesta de baliza manipulada. Debido a que el Agente utiliza TLS mutuo (mTLS) para verificar comandos de la Plataforma Rapid7, es poco probable que la funci\u00f3n eval() pudiera ser explotada remotamente sin acceso previo y altamente privilegiado a la plataforma de backend."}], "id": "CVE-2026-4837", "lastModified": "2026-07-24T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 5.9, "source": "cve@rapid7.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4837", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-09T03:56:13.769975Z", "version": "2.0.3"}}]}, "published": "2026-04-08T17:21:24.603", "references": [{"source": "cve@rapid7.com", "tags": ["Release Notes"], "url": "https://docs.rapid7.com/insight/release-notes-2026-april/#improvements-and-fixes"}], "sourceIdentifier": "cve@rapid7.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-95"}], "source": "cve@rapid7.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.1.0.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Insight Agent", "source": "cna", "vendor": "Rapid7"}, "product": "insight_agent", "vendor": "rapid7"}], "analysis": {"en": {"generated_at": "2026-04-08T17:50:30.079148+00:00", "value": {"mitigation_remediation": ["Check Rapid7\u2019s latest release notes for a patch or updated Insight Agent version and upgrade if available. If an update is unavailable, enforce strict access controls on the Rapid7 Platform to prevent unauthorized command injection. Monitor for abnormal beacon responses and consider disabling or sanitizing eval usage in any custom beacon handling logic."], "summary": {"action": "Assess Impact", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Linux installations of the Rapid7 Insight Agent are affected. Specific version information is not disclosed in the advisory, so all current releases may be susceptible until an update is applied.", "description_and_impact": "An injection flaw in the Rapid7 Insight Agent beaconing logic on Linux allows the eval() function to be executed with arbitrary payloads. This flaw could, in theory, enable an attacker to run code as root if a malicious beacon response is received. Because the agent authenticates commands with mutual TLS, the likelihood of exploitation without prior compromise of the backend platform is low, but the potential impact remains high if such an attack vector is realized.", "risk_and_exploitability": "The CVSS score of 6.6 indicates moderate to high severity. No EPSS score is available and the vulnerability is not listed in CISA\u2019s KEV catalog, suggesting limited publicly known exploitation. Nevertheless, the combination of root privilege execution and a reliance on protected communication means that a compromised backend platform could lead to complete system takeover. The overall risk is considered moderate but should be evaluated against the organization\u2019s exposure to the Rapid7 platform."}}}}, "created": "2026-04-08T19:26:50.063440+00:00", "updated": "2026-04-08T19:39:07.991761+00:00", "vendors": ["rapid7", "rapid7$PRODUCT$insight_agent"]}