CVE-2026-4482: Information Disclosure Vulnerability

CVE-2026-4482 Overview

CVE-2026-4482 is an insecure permissions vulnerability affecting installer certificate files on Windows systems. The certificate files located in the …/bootstrap/common/ssl folder are configured with overly permissive access controls, allowing standard authenticated users read and execute access. Of particular concern is the client.key file, which contains sensitive agent identity material that could be leveraged by attackers to impersonate legitimate agents or facilitate further exploitation.

Critical Impact

Exposure of agent identity material (client.key) to any locally authenticated standard user could enable agent impersonation, unauthorized access to protected resources, or serve as a stepping stone for lateral movement within the environment.

Affected Products

• Rapid7 Insight Platform components on Windows systems
• Windows installations with affected bootstrap/common/ssl folder configurations

Discovery Timeline

• April 10, 2026 - CVE-2026-4482 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-4482

Vulnerability Analysis

This vulnerability falls under CWE-732 (Incorrect Permission Assignment for Critical Resource). The core issue stems from improper file system permission configuration during the installation process on Windows systems. When the installer deploys certificate files to the …/bootstrap/common/ssl directory, it fails to apply sufficiently restrictive Access Control Lists (ACLs) to protect sensitive cryptographic material.

The client.key file is particularly sensitive as it contains the private key used to establish the agent's identity. In a properly configured environment, access to this file should be restricted to the SYSTEM account and specific administrative users or service accounts. However, the current permission model grants read and execute access to standard authenticated users, violating the principle of least privilege.

Root Cause

The root cause is an insecure default configuration in the Windows installer component. During installation, the file system permissions for the …/bootstrap/common/ssl directory and its contents are not properly restricted. This results in inherited or explicitly assigned permissions that allow the local Users group to read sensitive certificate and key files.

Windows file system ACLs support granular permission control, but the installer does not leverage this capability to protect the cryptographic assets appropriately. This configuration oversight exposes agent identity material to any user who can authenticate to the local system.

Attack Vector

Exploitation requires local access to the affected Windows system with standard user credentials. An attacker who has gained access to the system through any means (legitimate account, compromised credentials, or initial foothold from another vulnerability) can navigate to the …/bootstrap/common/ssl directory and read the contents of the client.key file.

With access to the private key, an attacker could potentially:

1. Impersonate the legitimate agent to backend services
2. Decrypt communications encrypted with the corresponding public key
3. Generate fraudulent signed requests that appear to originate from the trusted agent
4. Use the identity material as part of a larger attack chain for lateral movement

The attack requires no user interaction and can be executed programmatically, making it suitable for inclusion in automated post-exploitation toolkits.

Detection Methods for CVE-2026-4482

Indicators of Compromise

• Unusual file access events to …/bootstrap/common/ssl/client.key by non-service accounts
• Multiple users or unexpected processes reading certificate files in the bootstrap SSL directory
• Evidence of certificate or key file copying to user-writable locations
• Anomalous authentication attempts using cloned agent credentials

Detection Strategies

• Monitor file system audit events (Event ID 4663) for access to certificate files in the bootstrap/common/ssl directory
• Implement file integrity monitoring (FIM) on sensitive certificate directories to detect unauthorized reads
• Review process execution logs for commands accessing the ssl folder path from unexpected parent processes
• Configure SIEM rules to alert on standard user access to cryptographic key files

Monitoring Recommendations

• Enable Windows Security Auditing for object access on the affected directories
• Deploy endpoint detection and response (EDR) solutions with file access telemetry capabilities
• Create baseline of legitimate processes that access the certificate files and alert on deviations
• Monitor for exfiltration indicators such as key files being compressed or transmitted

How to Mitigate CVE-2026-4482

Immediate Actions Required

• Audit current file permissions on the …/bootstrap/common/ssl directory and contained files
• Restrict ACLs on client.key and other certificate files to SYSTEM and required service accounts only
• Remove read and execute permissions for the Users group and other non-essential principals
• Review system logs for any historical unauthorized access to the certificate files

Patch Information

Rapid7 has addressed this vulnerability in their April 2026 release. Organizations should apply the latest updates as detailed in the Rapid7 Release Notes April 2026. The fix ensures that installer certificate files are deployed with appropriately restrictive permissions on Windows systems.

Workarounds

• Manually adjust file permissions using icacls to remove access for the Users group
• Implement Group Policy to enforce restrictive permissions on the affected directory path
• Consider relocating sensitive certificate files to a more secure directory with restricted access
• Deploy compensating controls such as enhanced monitoring until patches can be applied

# Configuration example
# Restrict permissions on the client.key file using icacls
icacls "C:\path\to\bootstrap\common\ssl\client.key" /inheritance:r
icacls "C:\path\to\bootstrap\common\ssl\client.key" /grant:r "SYSTEM:(R)"
icacls "C:\path\to\bootstrap\common\ssl\client.key" /grant:r "Administrators:(R)"

# Verify the updated permissions
icacls "C:\path\to\bootstrap\common\ssl\client.key"