CVE-2026-8592 is an OS command injection in the process_string action of the Rapid7 InsightConnect AWK plugin on Linux (CVSS 7.7, high). Unsafe shell command construction lets text or expression values run commands. Update the plugin. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The record names the Rapid7 InsightConnect AWK plugin on Linux. The affected input is the text or expression parameters of the process_string action. The weakness is CWE-78, OS command injection. The vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L.
The record does not list a fixed plugin version, and the extension page did not return readable content for me. Check the plugin page on the Rapid7 extension library for the current version. The record is not in the CISA KEV catalog.
How to check if you're exposed
In InsightConnect, open the plugin list for your orchestrator and read the installed version of the AWK plugin. Compare it with the current version on the Rapid7 extension page. Then list the workflows that call the process_string action and note where their inputs come from.
What to do now
- Update the AWK plugin to the newest version on the Rapid7 extension library.
- List workflows that use process_string and see whether any pass untrusted text into it.
- Run orchestrator plugins with the least privileges possible on the host.
- Remove the plugin if no workflow needs it.
- Check orchestrator logs for odd inputs to the action.
Why it matters
The plugin builds a shell command from parameters. If a value contains shell syntax, the shell may treat it as extra commands. This is the classic injection pattern.
The safe approach is to avoid the shell, pass arguments as a list, or apply strict allowlists. Several sibling plugins from the same vendor have the same pattern, so review any text processing or network tool plugin you run.
Quick check
Is this the same as the Ping, Traceroute and Translate plugin flaws?
It is the same class of flaw in a different plugin. Each has its own CVE, so check every plugin you run.
Sources
Last reviewed: 19 October 2026.
