CVE-2026-8665 Overview
CVE-2026-8665 is an OS command injection vulnerability in the Rapid7 InsightConnect Translate Plugin (tr) on Linux. The flaw resides in the TR action, which builds shell commands from user-supplied text or expression parameters without adequate sanitization. Remote attackers can inject shell metacharacters to execute arbitrary operating system commands on the host running the plugin. The weakness is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command. Successful exploitation undermines the confidentiality and integrity of the plugin host and any orchestration workflows that route through it.
Critical Impact
Remote attackers can execute arbitrary OS commands on the Linux host running the InsightConnect Translate Plugin by supplying malicious text or expression parameters to the TR action.
Affected Products
- Rapid7 InsightConnect Translate Plugin (tr) on Linux
- Workflows invoking the TR action with attacker-influenced text or expression input
- See the Rapid7 Extension Information for plugin distribution details
Discovery Timeline
- 2026-06-25 - CVE-2026-8665 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-8665
Vulnerability Analysis
The Translate Plugin exposes a TR action that wraps the Linux tr utility to transform text supplied through orchestration playbooks. The plugin constructs a shell command string that concatenates the text and expression parameters directly into the command line. Because the inputs are not escaped or passed through a safe argument array, shell metacharacters such as ;, |, `, $(), and && retain their semantic meaning when the command is evaluated by the shell.
An attacker who can submit values to a workflow that calls the TR action can break out of the intended argument context and append arbitrary commands. The injected commands execute under the identity of the InsightConnect orchestrator process on the Linux host, which typically has access to integrations, API tokens, and credentials configured for automation. The plugin is reachable through the orchestration platform, so exploitation does not require local access or authenticated user interaction on the host itself.
Root Cause
The root cause is insufficient input sanitization during shell command construction. The action builds a single command string and hands it to a shell interpreter rather than invoking the binary with a fixed argument vector. Any metacharacter present in text or expression is therefore interpreted by the shell instead of being treated as literal data passed to tr.
Attack Vector
Exploitation occurs over the network through the InsightConnect workflow surface. An attacker influences the text or expression parameter consumed by the TR action, for example by routing untrusted input from an upstream trigger, webhook, alert source, or external integration into the action. When the workflow executes, the shell expands the injected payload and runs the attacker's commands. A typical payload appends a command separator and a follow-on command, such as terminating the intended tr invocation and chaining a reverse shell, credential dump, or download-and-execute primitive. Successful exploitation yields command execution with the privileges of the plugin process and can pivot into connected systems via stored integration credentials.
Detection Methods for CVE-2026-8665
Indicators of Compromise
- Process trees where the InsightConnect orchestrator or Translate Plugin process spawns shells (sh, bash) followed by unexpected children such as curl, wget, nc, python, or /tmp/* binaries.
- Workflow execution logs containing shell metacharacters (;, |, &&, `, $() inside the text or expression parameters of TR actions.
- Outbound network connections from the plugin host to untrusted or newly observed destinations immediately following a workflow run.
Detection Strategies
- Inspect InsightConnect job and audit logs for invocations of the TR action carrying suspicious characters in text or expression fields.
- Baseline the legitimate child processes of the orchestrator and alert on deviations, especially shells, interpreters, or file write activity in world-writable directories.
- Correlate workflow execution timestamps with host-level command execution telemetry to identify command sequences that do not match expected tr usage.
Monitoring Recommendations
- Forward InsightConnect orchestrator logs and Linux auditd or execve telemetry to a central analytics platform for retrospective hunting.
- Alert on any new outbound connections initiated by the plugin user account, particularly to non-corporate IP space.
- Track changes to integration credentials and API tokens accessible to the orchestrator after suspicious workflow runs.
How to Mitigate CVE-2026-8665
Immediate Actions Required
- Update the Rapid7 InsightConnect Translate Plugin to the fixed version published on the Rapid7 Extensions portal.
- Audit existing workflows that call the TR action and identify any path where untrusted input reaches the text or expression parameters.
- Rotate integration credentials, API keys, and secrets stored on orchestrator hosts that ran vulnerable plugin versions.
Patch Information
Apply the latest version of the Translate Plugin from the Rapid7 extension marketplace. Refer to the Rapid7 Extension Information page for the current release and changelog. Restart affected orchestrator services after upgrade to ensure the patched plugin code is loaded.
Workarounds
- Disable or remove the Translate Plugin from orchestrators until the patched version is deployed.
- Constrain workflow inputs by validating upstream parameters against an allowlist of characters before they reach the TR action.
- Run the InsightConnect orchestrator under a least-privilege Linux account with restricted network egress and no access to sensitive credential stores.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
