CVE-2026-4837: rapid7 insight_agent Eval Injection

Vulnerability summary

CVE-2026-4837 is a high (CVSS 7.2) Eval Injection vulnerability in rapid7 insight_agent. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53.4% of scored vulnerabilities.

Timeline

1. 08-04-2026
   PublishedVulnerability first disclosed.
2. 13-04-2026
   Last modifiedVulnerability information updated.

Description

An eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve remote code execution as root via a crafted beacon response. Because the Agent uses mutual TLS (mTLS) to verify commands from the Rapid7 Platform, it is unlikely that the eval() function could be exploited remotely without prior, highly privileged access to the backend platform.

• CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").