CVE-2026-4837 Eval Injection in Rapid7 Insight Agent
An eval injection in Rapid7 Insight Agent allows remote code execution as root if an attacker controls beacon responses, though mTLS mitigates remote exploitation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-4837?
CVE-2026-4837 is a medium-severity code injection vulnerability in Rapid7 Insight Agent, published on 8 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve remote code execution as root via a crafted beacon response. Because the Agent uses mutual TLS (mTLS) to verify commands from the Rapid7 Platform, it is unlikely that the eval() function could be exploited remotely without prior, highly privileged access to the backend platform.
Weakness: CWE-95
Which versions are affected by CVE-2026-4837?
It affects 1 product.
Products include Rapid7 Insight Agent.
How do I fix CVE-2026-4837?
No fix has been published for CVE-2026-4837 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-4837 being exploited?
There is no known exploitation of CVE-2026-4837 in the wild and no public exploit code.
Other vulnerabilities in Rapid7 Insight Agent
- CVE-2026-6482 Local Privilege Escalation via OpenSSL configuration file in Insight Agent
- CVE-2021-4007 Rapid7 Insight Agent Privilege Escalation
- CVE-2019-5629 Privilege escalation in Insight Agent
- CVE-2026-4482 Insight Agent Private Key Information Disclosure via Inherited File Permissions
- CVE-2023-2273 Rapid7 Insight Agent Directory Traversal
Sources
Also known as GHSA-5gqp-c836-45cr.