An injection flaw in the Rapid7 Insight Agent beaconing logic on Linux allows the eval() function to be executed with arbitrary payloads. This flaw could, in theory, enable an attacker to run code as root if a malicious beacon response is received. Because the agent authenticates commands with mutual TLS, the likelihood of exploitation without prior compromise of the backend platform is low, but the potential impact remains high if such an attack vector is realized.

Linux installations of the Rapid7 Insight Agent are affected. Specific version information is not disclosed in the advisory, so all current releases may be susceptible until an update is applied.

The CVSS score of 6.6 indicates moderate to high severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited publicly known exploitation. Nevertheless, the combination of root privilege execution and a reliance on protected communication means that a compromised backend platform could lead to complete system takeover. The overall risk is considered moderate but should be evaluated against the organization’s exposure to the Rapid7 platform.