Technical impact
A vulnerability in the Rapid7 Insight Agent installer allows local Windows users to read the client.key file located in the bootstrap/common/ssl directory, exposing the agent's private key material. This information disclosure could enable an attacker to impersonate the agent or masquerade as an authorized entity, potentially leading to unauthorized access or data compromise. The weak file permissions represent a flaw in access control management, identified as CWE‑732.
Affected Systems
The flaw affects Rapid7 Insight Agent running on Windows systems. No specific product versions are listed in the advisory, so all installations of the agent that use the default installer permissions are potentially vulnerable.
Risk and Exploitability
The CVSS v3 score of 6.8 indicates moderate severity, and the lack of documented exploits or known public exploits reduces the immediate risk. However, the vulnerability is locally exploitable by any authenticated standard user, meaning that a user with normal access rights can read the private key. The EPSS score is not provided and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not widely exploited yet. Because the attack requires only local file permission errors, it is relatively easy to exploit and could be leveraged to compromise the integrity and confidentiality of the system.
