CVE-2026-4482: 
Rapid7 Insight Cloud Agent vulnerability analysis and mitigation

CVE-2026-4482 is an incorrect permission assignment vulnerability in Rapid7 Insight Agent for Windows that exposes agent identity material (specifically the client.key file) to any locally authenticated standard user. The vulnerability affects all Insight Agent versions prior to 4.1.0.2 and was published on April 10, 2026. It is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource) and carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.8 (Medium) (GitHub Advisory, Rapid7 Release Notes).

The root cause is CWE-732: Incorrect Permission Assignment for Critical Resource. During installation, the Rapid7 Insight Agent places certificate files — including the private key client.key — in the .../bootstrap/common/ssl directory on Windows systems without applying restrictive file system permissions, leaving them readable and executable by standard (non-privileged) local user accounts. An attacker with any local authenticated session can directly read the client.key file using standard file system access, requiring no privilege escalation or special tooling. No public proof-of-concept exploit code has been identified (GitHub Advisory).

Successful exploitation allows a locally authenticated standard user to read the client.key file, thereby obtaining the Insight Agent's identity material (private key and associated certificates). This could enable an attacker to impersonate the agent to Rapid7's backend infrastructure, potentially undermining the integrity and availability of agent-reported data and security telemetry. The primary impact is high confidentiality loss of the agent credential material, with secondary low integrity and availability impacts on subsequent systems that trust the agent identity (GitHub Advisory, Rapid7 Release Notes).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept as of the time of writing. The EPSS score is approximately 0.009% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local authenticated access to the affected Windows system, limiting the attacker pool (GitHub Advisory).

1. Gain local access: Obtain a locally authenticated standard user account on a Windows system running Rapid7 Insight Agent versions prior to 4.1.0.2 (e.g., via phishing, credential theft, or physical access).
2. Locate the SSL directory: Navigate to the Insight Agent installation path and find the .../bootstrap/common/ssl folder, which contains certificate and key files.
3. Read the client.key file: Use standard file system commands (e.g., type client.key in CMD or Get-Content client.key in PowerShell) to read the private key, which is accessible due to overly permissive file ACLs.
4. Extract agent identity material: Copy the client.key and associated certificate files for offline use.
5. Impersonate the agent: Use the extracted key material to craft or replay TLS client authentication requests to Rapid7 backend services, potentially impersonating the agent and manipulating security telemetry or gaining unauthorized access to agent-managed data (GitHub Advisory).

• File System: Unexpected access or copying of files in .../bootstrap/common/ssl/ directory, particularly client.key; presence of these files in unusual locations or user-accessible directories.
• Logs: Windows Security Event Log entries (Event ID 4663) showing read access to client.key or other files in the bootstrap/common/ssl folder by non-administrative user accounts.
• Process: Unusual processes (e.g., cmd.exe, powershell.exe, file archiving tools) accessing the Insight Agent SSL directory under a standard user context.
• Network: Unexpected or duplicate agent authentication attempts to Rapid7 backend endpoints originating from unusual source IPs or systems not running the Insight Agent.

Rapid7 has addressed this vulnerability in Insight Agent version 4.1.0.2, which applies appropriate file system permissions to the bootstrap/common/ssl directory. Organizations should upgrade to version 4.1.0.2 or later as the primary remediation. As an interim workaround prior to patching, administrators should manually restrict file permissions on the .../bootstrap/common/ssl directory and the client.key file to prevent read access by standard user accounts on Windows (e.g., using icacls to remove non-administrative user permissions). Additionally, limiting local system access to authorized personnel reduces exposure (Rapid7 Release Notes, GitHub Advisory).