The Rapid7 Insight Agent installer on Windows systems sets insufficiently restrictive permissions on certificate files located in the bootstrap/common/ssl directory. The client.key file, which contains sensitive agent identity credentials, is readable and executable by any locally authenticated standard user. This permission misconfiguration (CWE-732) could allow unauthorized local users to access critical security material. The vulnerability has a CVSS 4.0 score of 6.8, indicating medium severity. No official fix or patch has been released as of the publication date, and no exploits have been observed in the wild. The issue is specific to the Windows installer and does not affect cloud-hosted services.

Exposure of the client.key file to any locally authenticated standard user could lead to unauthorized access to agent identity material. This may compromise the security context of the Insight Agent on affected Windows systems. However, there are no reports of active exploitation, and the impact is limited to local users with standard authentication privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the bootstrap/common/ssl folder and its contents by manually adjusting file permissions to limit read and execute access to only authorized users or administrators. Monitor Rapid7 advisories for updates and apply any official patches promptly once available.