CVE-2026-1814

Title: Rapid7 Nexpose – Weak Keystore Password Generation
CVE ID: CVE-2026-1814
CVSS Base Score: 7.5
Severity: High
Attack Vector: Local
Privileges Required: High
User Interaction: None
Exploitability: Moderate (offline attack once file is obtained)
Exploit Availability: No known public weaponized exploit; theoretical and educational PoC scenarios possible

Overview

A security weakness was identified in Rapid7 Nexpose related to how passwords are generated for its internal Java keystore. The keystore is used by the application to securely store sensitive credentials required for scanning, integrations, and internal services. Due to an implementation flaw in the password generation logic, the resulting keystore password lacks sufficient randomness (low entropy).

Because of this weakness, if an attacker manages to obtain a copy of the Nexpose keystore file, the password protecting that keystore can be brute-forced offline in a reasonable amount of time. Once the keystore is unlocked, stored credentials may be exposed.

Technical Description

During keystore creation or upgrade, Nexpose relies on an internal method to generate a random password for protecting the Java keystore file (commonly nsc.ks). The generation logic does not use a cryptographically strong source of randomness and produces passwords with predictable characteristics such as a fixed prefix and limited length.

This significantly reduces the effective password space. While the keystore itself is encrypted, the weak password undermines that protection, allowing attackers to attempt offline brute-force attacks without triggering alerts or rate limits.

Affected Components

• Rapid7 Nexpose / InsightVM installations that rely on the affected keystore password generation logic
• Systems where the Nexpose keystore file is accessible to privileged local users, backup operators, or attackers who gain filesystem access

Impact

If successfully exploited, this vulnerability may result in:

• Disclosure of credentials stored in the Nexpose keystore
• Unauthorized access to internal services or integrated systems
• Potential lateral movement using recovered service accounts
• Increased risk if the same credentials are reused elsewhere

The vulnerability does not allow remote exploitation by itself; access to the keystore file is a prerequisite.

Exploitation Scenario

A realistic exploitation path would involve the following steps:

1. Local or privileged access is gained to the Nexpose server (for example via compromised admin credentials, insecure backups, or misconfigured file permissions).
2. The attacker copies the keystore file (nsc.ks) from the filesystem or from a backup location.
3. An offline brute-force attack is performed against the keystore password using commonly available Java keystore tooling.
4. Once decrypted, stored secrets such as database credentials, service passwords, or API keys are extracted and misused.

Because the attack is fully offline after file acquisition, it is difficult to detect at the brute-force stage.

Proof of Concept (Educational)

No publicly released exploit code is currently known. However, from an educational and defensive standpoint, the weakness can be demonstrated by attempting to brute-force a test keystore created using the vulnerable password generation logic.

Such demonstrations typically involve:

• Using standard Java keytool utilities
• Generating wordlists that match the predictable password pattern
• Measuring how quickly the keystore password can be recovered

These demonstrations should only be performed in controlled lab environments for validation and awareness purposes.

Detection and Monitoring Guidance

What Can Be Detected

Since exploitation is offline, detection should focus on pre-exploitation and post-exploitation indicators rather than brute-force activity itself.

Recommended Log Sources

• Operating system audit logs (file access and permission changes)
• Endpoint Detection & Response (EDR) telemetry
• Backup system access logs
• Authentication logs for services integrated with Nexpose

Indicators to Monitor

• Unauthorized or unusual access to the keystore file (nsc.ks)
• Unexpected file copies, archives, or transfers involving Nexpose directories
• Keystore files appearing in backup exports or user home directories
• Sudden authentication attempts using Nexpose-related service accounts
• Use of credentials shortly after keystore access events

Detection Use Cases

• Alert when non-Nexpose processes read or copy nsc.ks
• Alert on outbound transfers of files matching keystore naming patterns
• Correlate keystore access events with new authentication attempts from unusual sources

Mitigation and Remediation

Immediate Actions

• Upgrade Nexpose / InsightVM to a fixed version provided by Rapid7
• Regenerate or rebuild the keystore using a strong, high-entropy password
• Rotate all credentials stored in the keystore after upgrading
• Restrict filesystem permissions to ensure only the Nexpose service account can access keystore files
• Secure and encrypt backups that may contain keystore material

Long-Term Hardening

• Avoid credential reuse across systems
• Implement strict access control and monitoring on security tooling servers
• Regularly audit sensitive files for unauthorized access
• Consider external secrets management solutions where feasible

MITRE Mapping

• CWE-331: Insufficient Entropy
• MITRE ATT&CK (Relevant Techniques):
  • Credential Access – Unsecured Credentials
  • Lateral Movement – Valid Accounts

Official Patch / Upgrade Information

Rapid7 has addressed this issue in updated releases of Nexpose / InsightVM. Administrators should review and apply the latest supported version using the official Rapid7 documentation and upgrade guidance:

Official Rapid7 Release Notes / Upgrade Information:
https://docs.rapid7.com/insight/release-notes-2026-february

Final Takeaway

This vulnerability highlights the importance of strong cryptographic practices even for internally generated secrets. While exploitation requires privileged access, the potential impact is significant once that access is achieved. Applying vendor updates, rotating credentials, and monitoring sensitive file access remain the most effective defenses against this issue.