Critical 9.8Published Oct 13, 2026

CVE-2026-87689Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints

Updated under an hour ago (2026-10-19 11:10 UTC)

Does this affect you?

It affects Rapid7 Metasploit Framework. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.37%, higher than 29% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Rapid7 Metasploit Framework

Exploited in the last 30 days

The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-306
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.37% (percentile 29)
Assigned by: rapid7
NVD analysis: Awaiting Analysis
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 13, 2026

Affected products

Affected products

Rapid7 Metasploit Framework rapid7:metasploit_framework (from the name)	through 6.5.4; 6.5.5 not affected	CNA record

References

https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5release-notes, patch
https://github.com/rapid7/metasploit-frameworkproduct

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.