CVE-2026-8666 is an OS command injection in the traceroute action of the Rapid7 InsightConnect Traceroute plugin on Linux (CVSS 7.7, high). Five request parameters feed shell commands without enough validation. Update the plugin. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The record names the Traceroute plugin on Linux. The exposed parameters are host, port, max_ttl, count and time_out. The weakness is CWE-78, OS command injection. The vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L.
The record does not list a fixed version, and the extension page was not readable for me. Use the plugin page to find the latest release. The record is not in the CISA KEV catalog.
How to check if you're exposed
In InsightConnect, find the installed Traceroute plugin version and compare it with the extension page. Review workflows that call the traceroute action, and check which of the five parameters take outside input.
What to do now
- Update the Traceroute plugin to the latest version.
- Validate numeric parameters as numbers and the host as an address or hostname before use.
- Review which workflows can reach the action and who can trigger them.
- Run orchestrator hosts with limited privileges.
- Remove the plugin if it is unused.
Why it matters
Numeric options such as port and count look safe, yet they are often passed as strings into a command line. Any parameter that reaches a shell string is a possible injection point, not only the host.
A good rule is to convert numeric inputs to integers before use, and to pass arguments to a process as a list.
Quick check
Which parameters are affected?
The record lists host, port, max_ttl, count and time_out.
Sources
Last reviewed: 19 October 2026.
