CVSS 9.8: Rapid7 Patches Critical Metasploit Web Service Auth Bypass in v6.5.5

The short version

• The Metasploit Framework Web Service contains a critical authentication bypass affecting versions up to 6.5.4.
• Attackers can read, modify, or delete stored credentials without providing any authentication credentials.
• Rapid7 addressed the issue in version 6.5.5 by adding mandatory authentication checks to specific handlers.

The details

The National Vulnerability Database assigned CVE-2026-87689 a CVSS score of 9.8, classifying the severity as Critical. This vulnerability stems from a coding oversight in the Metasploit Framework Web Service REST API, specifically within the Msf::WebServices::CredentialServlet component. According to the NVD record, the flaw allows any client that can reach the web service to interact with the credential store without presenting valid authentication tokens.

The vulnerability exists because two specific API handlers, update_credential and delete_credentials, omit the standard warden.authenticate! call. These handlers process PUT and DELETE requests for the /api/v1/credentials endpoint. Because they skip authentication, they pass requests directly to lib/msf/core/db_manager/cred.rb, which performs no authorization checks. This gap allows unauthenticated users to permanently delete or modify every stored credential record, including passwords, hashes, and private keys used for shared team engagements.

All published versions of the Metasploit Framework through 6.5.4 are affected by this issue. The default listener for the web service binds to 0.0.0.0 on port 8080, making it accessible to any client on the network if no additional network segmentation is in place. Rapid7 released version 6.5.5 to resolve the problem. The update adds the warden.authenticate! call as the first statement in both the update and delete handlers, aligning them with the security pattern used by every other route in the API.

The context

The Metasploit Framework is a widely used penetration testing tool developed by Rapid7. Its web service component, msf-ws, allows users to interact with the framework programmatically via a REST API. The credential store is a critical feature that saves sensitive data such as passwords and private keys for use during security assessments. The omission of authentication checks in specific mutating routes represents a significant deviation from the security model implemented in the rest of the API.

What should you do?

Administrators running Metasploit Framework should immediately verify their current version. If the installation is version 6.5.4 or earlier, users should upgrade to version 6.5.5 as soon as possible. Until the update is applied, restricting network access to the web service port 8080 can help mitigate exposure. Users should also audit their credential stores for any signs of unauthorized modification or deletion.

What to do and how to stay safe: Metasploit Framework

• Verify the installed version of Metasploit Framework and upgrade to 6.5.5 if running 6.5.4 or earlier.
• Restrict network access to the Metasploit Web Service port 8080 to trusted IPs only.
• Monitor logs for unauthorized PUT or DELETE requests to the /api/v1/credentials endpoint.
• Rotate any credentials stored in the Metasploit database that may have been exposed or deleted.

Step-by-step guide: Automatic Software Updates: 8 FAQs on Security and Risk

General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-87689?

The National Vulnerability Database rates CVE-2026-87689 as Critical with a CVSS score of 9.8.

Which versions of Metasploit Framework are affected?

All published versions of the Metasploit Framework up to and including 6.5.4 are affected.

How does Rapid7 fix this vulnerability?

Rapid7 fixed the issue in version 6.5.5 by adding warden.authenticate! to the update and delete handlers.