Vulnerability · Published Feb 3, 2026 · Assigned by rapid7
CVE-2026-1568Rapid7 InsightVM Signature Validation Vulnerability
Critical 9.6
In plain English
A critical-severity improper authentication in Vulnerability Management from Rapid7. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Official description
Rapid7 InsightVM versions before 8.34.0 contain a signature verification issue on the Assertion Consumer Service (ACS) cloud endpoint that could allow an attacker to gain unauthorized access to InsightVM accounts setup via "Security Console" installations, resulting in full account takeover. The issue occurs due to the application processing these unsigned assertions and issuing session cookies that granted access to the targeted user accounts. This has been fixed in version 8.34.0 of InsightVM.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rapid7 | Vulnerability Management | 0 – before 8.34.0 |
Weakness: CWE-347, CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N