Rapid7 InsightVM Signature Validation Vulnerability

The impact of CVE-2026-1568 is severe, enabling an attacker to achieve full account takeover of Rapid7 InsightVM instances. This means an attacker could gain complete control over the security console, potentially modifying security policies, accessing sensitive data like vulnerability scan results and asset inventories, and even launching further attacks against the network. The vulnerability’s reliance on unsigned assertions makes it particularly concerning, as it bypasses a fundamental security control. This could be leveraged to pivot to other systems within the network, especially if the InsightVM console has elevated privileges or access to critical infrastructure. The ability to modify security policies could also lead to a denial of service or further compromise of the environment.

Organizations heavily reliant on Rapid7 InsightVM for vulnerability management and security posture assessment are at significant risk. Specifically, those with 'Security Console' installations and those who have not implemented robust access controls or MFA on their InsightVM consoles are particularly vulnerable. Shared hosting environments where multiple users share an InsightVM instance also face increased risk.

• windows / supply-chain: Monitor PowerShell execution for commands related to InsightVM configuration or authentication. Examine scheduled tasks for suspicious scripts. • linux / server: Review InsightVM logs (typically located in /opt/rapid7/insightvm/logs) for unusual authentication attempts or errors related to assertion processing. Use journalctl -u insightvm to filter for relevant events. • generic web: Monitor access logs for requests to the ACS endpoint with unusual headers or parameters. Check response headers for signs of unauthorized access.

1. 2026-02-03Disclosure

   disclosure

1. 已保留2026-01-28
2. 发布日期2026-02-03
3. 修改日期2026-02-26
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-1568 is to immediately upgrade Rapid7 InsightVM to version 8.34.0 or later. If an immediate upgrade is not feasible due to compatibility concerns or testing requirements, Rapid7 recommends reviewing the ACS configuration and ensuring that all assertions are properly signed and verified. While a direct workaround is not available, implementing stricter access controls and multi-factor authentication (MFA) on the InsightVM console can help limit the potential damage if the vulnerability is exploited. After upgrading, confirm the fix by attempting to submit an unsigned assertion to the ACS endpoint and verifying that it is rejected.