CVE-2026-1568: Rapid7 InsightVM Auth Bypass Vulnerability

CVE-2026-1568 Overview

CVE-2026-1568 is an Authentication Bypass vulnerability affecting Rapid7 InsightVM versions before 8.34.0. The vulnerability exists in the Assertion Consumer Service (ACS) cloud endpoint, where a signature verification issue allows attackers to gain unauthorized access to InsightVM accounts configured via "Security Console" installations. The flaw results from the application improperly processing unsigned SAML assertions and issuing valid session cookies, enabling complete account takeover.

Critical Impact

This vulnerability enables full account takeover of Rapid7 InsightVM accounts through signature verification bypass on the ACS endpoint, potentially compromising vulnerability management infrastructure and sensitive security data.

Affected Products

• Rapid7 InsightVM versions prior to 8.34.0
• InsightVM installations configured via "Security Console"
• Rapid7 Command Platform cloud endpoints

Discovery Timeline

• 2026-02-03 - CVE-2026-1568 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-1568

Vulnerability Analysis

This vulnerability is classified under CWE-287 (Improper Authentication) and affects the SAML-based authentication flow in Rapid7 InsightVM. The core issue lies in the Assertion Consumer Service (ACS) endpoint's failure to properly validate cryptographic signatures on SAML assertions before processing them.

In a secure SAML implementation, the Identity Provider (IdP) digitally signs assertions to ensure their integrity and authenticity. The Service Provider (InsightVM in this case) must verify these signatures before trusting the assertion content. However, the vulnerable versions of InsightVM accept and process unsigned assertions, allowing attackers to craft malicious SAML responses that impersonate legitimate users.

When an attacker submits a forged unsigned SAML assertion targeting a specific user account, InsightVM's ACS endpoint processes the assertion without signature verification and issues a valid session cookie for the targeted account. This grants the attacker full access to the victim's InsightVM account, including all associated vulnerability data, scan configurations, and security reports.

Root Cause

The root cause of this vulnerability is the improper implementation of SAML signature verification in the ACS cloud endpoint. The application fails to enforce signature validation as a mandatory security control, allowing unsigned assertions to be processed as if they were legitimate authenticated requests. This represents a fundamental failure in the authentication chain for SAML-based Single Sign-On (SSO) implementations.

Attack Vector

This vulnerability is exploitable over the network without requiring user interaction. An attacker with low privileges can craft a malicious SAML assertion targeting any user account configured through the Security Console installation. The attack flow involves:

1. The attacker identifies a target InsightVM account and its associated Security Console installation
2. A malicious SAML assertion is crafted without cryptographic signature, specifying the target user's identity
3. The forged assertion is submitted to the vulnerable ACS cloud endpoint
4. InsightVM processes the unsigned assertion and issues a valid session cookie
5. The attacker uses the session cookie to access the targeted account with full privileges

The vulnerability can be exploited to gain access to sensitive vulnerability scan data, modify scan configurations, access network topology information, and potentially pivot to other systems within the organization's security infrastructure.

Detection Methods for CVE-2026-1568

Indicators of Compromise

• Anomalous SAML authentication events lacking valid cryptographic signatures in authentication logs
• Session creation events for users without corresponding IdP-initiated authentication flows
• Multiple authentication events from unusual IP addresses or geographic locations for the same user account
• Unexpected access patterns to vulnerability data or administrative functions following suspicious authentication events

Detection Strategies

• Monitor ACS endpoint logs for SAML assertions that lack signature elements or contain invalid signature data
• Implement alerting on authentication events that originate from unexpected sources or fail signature validation checks
• Correlate InsightVM access logs with IdP authentication logs to identify sessions created without valid IdP involvement
• Deploy network monitoring to detect crafted SAML assertion submissions to the ACS endpoint

Monitoring Recommendations

• Enable verbose logging on InsightVM authentication events and SAML processing
• Implement Security Information and Event Management (SIEM) rules to detect authentication anomalies
• Regularly audit active sessions and access patterns for signs of unauthorized access
• Review authentication configuration to ensure proper SSO integration with signature enforcement

How to Mitigate CVE-2026-1568

Immediate Actions Required

• Upgrade Rapid7 InsightVM to version 8.34.0 or later immediately to address the signature verification vulnerability
• Review authentication logs for signs of exploitation prior to patching
• Audit all active sessions and terminate any suspicious or unauthorized sessions
• Verify SSO configuration and ensure IdP is properly configured with valid certificates

Patch Information

Rapid7 has released version 8.34.0 of InsightVM which addresses this signature verification vulnerability. Organizations should prioritize this upgrade given the critical nature of the vulnerability and its potential for full account takeover. For detailed release information, see the Rapid7 Command Platform Release Notes.

Workarounds

• If immediate patching is not possible, consider temporarily restricting network access to the InsightVM ACS endpoint
• Implement additional network-level authentication controls in front of the ACS endpoint
• Enhance monitoring and alerting for authentication-related events during the interim period
• Consider temporarily disabling SAML-based SSO and using alternative authentication methods until the patch can be applied

# Verify InsightVM version after upgrade
# Access the Security Console and navigate to Administration > Updates
# Confirm version 8.34.0 or later is installed

# Review authentication logs for suspicious activity
# Log location varies by installation - check Rapid7 documentation
# Look for SAML authentication events without valid signatures