Key points
- CVE-2026-87689 allows unauthenticated read, modify, and delete actions on stored credentials.
- The flaw affects all published Metasploit Framework versions through 6.5.4.
- Rapid7 resolved the issue by enforcing authentication in version 6.5.5.
Rapid7 has released version 6.5.5 of the Metasploit Framework to address a critical authentication bypass vulnerability. The flaw, tracked as CVE-2026-87689, carries a CVSS score of 9.8 and permits any network user to manipulate credential data without presenting valid login tokens. The issue stems from missing authentication checks in specific REST API handlers within the Metasploit Framework Web Service component.
How it unfolded
- The vulnerability exists within the Msf::WebServices::CredentialServlet of the Metasploit Framework Web Service.
- Most API routes enforce authentication via warden.authenticate! before processing requests.
- The update_credential and delete_credentials handlers omitted this critical security step entirely.
Because these specific handlers for the /api/v1/credentials endpoint skipped the standard authentication verification, they passed requests directly to the underlying database manager library. This library, lib/msf/core/db_manager/cred.rb, does not perform its own authorization checks. Consequently, any client capable of reaching the web service interface could execute mutating commands against the credential store.
Who is affected
All published versions of the Metasploit Framework up to and including version 6.5.4 are affected by this vulnerability. The default web service listener binds to 0.0.0.0:8080, which exposes the interface to any host on the local network. Attackers do not need valid user credentials to exploit this flaw, as the missing authentication gate allows unrestricted access to the API endpoints.
Organizations using the Metasploit Framework for penetration testing or red team operations face significant risk if their deployments are exposed. The flaw allows attackers to read, modify, or permanently delete every stored credential record in the database. This includes sensitive data such as plaintext passwords, cryptographic hashes, and private keys shared among team members.
What happens next
Rapid7 addressed the issue in version 6.5.5 by adding the warden.authenticate! call as the first statement in both affected handlers. This change aligns the update and delete routes with the security pattern used by every other route in the API. Administrators must upgrade their Metasploit Framework installations to version 6.5.5 or later to mitigate the risk of unauthorized credential access.
Users running older versions should restrict network access to the Metasploit Web Service immediately. Since no patch exists for versions prior to 6.5.5, isolating the service from untrusted networks is the only viable temporary control. The vendor has confirmed that the fix is available and resolves the unauthenticated access vector completely.
What to do and how to stay safe: Metasploit Framework
- Upgrade Metasploit Framework installations to version 6.5.5 or later to apply the vendor-provided patch.
- Restrict network access to the Metasploit Web Service port 8080 using firewalls or security groups.
- Audit logs for unauthorized PUT or DELETE requests to the /api/v1/credentials endpoint.
- Rotate any credentials or keys that were stored in the database before applying the fix.
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-87689?
The National Vulnerability Database rates CVE-2026-87689 as critical with a CVSS score of 9.8.
Which Metasploit versions are vulnerable?
All published versions of the Metasploit Framework through 6.5.4 are affected by this flaw.
How was the vulnerability fixed?
Version 6.5.5 adds warden.authenticate! to the update and delete handlers to enforce authentication.
