CVE-2026-87689
Received Received - Intake

Authentication Bypass in Metasploit Framework Web Service

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Rapid7, Inc.

Description
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-87689
EUVD
EUVD-2026-98205

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Rapid7 Metasploit Framework 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Metasploit Framework Web Service REST API (msf-ws) allows unauthorized access to the credential store. Two specific API endpoints for updating and deleting credentials do not require authentication, enabling any user to read, modify, or delete stored credentials like passwords, hashes, and private keys without permission.

Detection Guidance

Check if the Metasploit Framework Web Service REST API (msf-ws) is running on port 8080. Use commands like 'netstat -tulnp | grep 8080' or 'ss -tulnp | grep 8080' to verify. If active, inspect API endpoints for /api/v1/credentials with PUT or DELETE methods to confirm missing authentication.

Impact Analysis

If you use Metasploit Framework versions up to 6.5.4, an attacker could exploit this flaw to steal sensitive credentials, alter stored data, or delete critical information used for team engagements. This could lead to data breaches, unauthorized access to systems, or loss of operational data.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by exposing or allowing unauthorized access to sensitive personal or health data stored as credentials. Organizations using affected versions may face legal penalties, data breach notifications, and reputational damage.

Mitigation Strategies

Upgrade Metasploit Framework to version 6.5.5 or later to fix the missing authentication in credential handlers. Ensure the msf-ws service is not exposed to untrusted networks or the internet. Restrict access to the default 0.0.0.0:8080 listener to authorized users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87689. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart