Metasploit Web Service Exposes Credentials Without Authentication

A critical security flaw in the Metasploit Framework Web Service allows unauthenticated users to access the entire credential store. The National Vulnerability Database assigned the issue CVE-2026-87689 and rated it Critical with a CVSS score of 9.8. This vulnerability impacts every published version of the software through 6.5.4, exposing sensitive data to anyone who can reach the service.

What is the technical cause of this vulnerability?

The flaw resides in the Msf::WebServices::CredentialServlet component of the Metasploit Framework Web Service REST API. While most routes in this servlet require authentication via warden.authenticate!, the handlers for updating and deleting credentials omit this check. Specifically, the PUT and DELETE methods for the /api/v1/credentials endpoint process requests without verifying the user's identity.

Because these handlers call directly into the core database manager library, which performs no independent authorization checks, the system trusts any incoming request. This architectural oversight means that the security boundary is completely bypassed for these specific operations, allowing full manipulation of the data store without any credentials.

What data is at risk from this exposure?

Any client that can reach the web service on its default 0.0.0.0:8080 listener can interact with the credential store. The vulnerability allows attackers to read, modify, or permanently delete every stored credential record. This includes sensitive items such as passwords, cryptographic hashes, and private keys that are often stored for shared team engagements.

The scope of the exposure is total for the affected endpoints. Since no authentication is required, an attacker does not need to guess passwords or exploit additional vulnerabilities. They simply need network access to the host running the Metasploit Framework Web Service to compromise the entire repository of stored secrets.

Which versions are affected and is there a fix?

All published versions of the Metasploit Framework up to 6.5.4 are affected by this issue. The vendor, Rapid7, addressed the flaw in version 6.5.5. The fix involves adding the warden.authenticate! call as the first statement in both the update and delete handlers. This change aligns these endpoints with the security pattern used by every other route in the API.

Organizations running versions prior to 6.5.5 remain vulnerable until they upgrade. The National Vulnerability Database record confirms that the weakness is classified under CWE-306, which relates to incorrect default permissions. The patch restores the expected authentication barrier for mutating and read operations on the credential servlet.

What are the operational implications for teams?

Security teams using the Metasploit Framework for penetration testing or red team exercises face significant risk. If the web service is exposed to networks beyond the immediate control of the testing team, adversaries could harvest credentials used in the engagement. This could lead to the compromise of additional systems or the deletion of critical data needed for the assessment.

The ease of exploitation makes this a high-priority issue for any organization deploying the framework. Because the default listener is bound to all interfaces, misconfigurations or lack of network segmentation can inadvertently expose the service. Ensuring that only version 6.5.5 or later is deployed mitigates the risk of unauthorized credential access.

What to do and how to stay safe: Metasploit Framework

• Audit network configurations to ensure the Metasploit Web Service listener is not accessible from untrusted networks.
• Verify the installed version of the Metasploit Framework and upgrade to 6.5.5 or later to apply the authentication fix.
• Review access logs for unusual PUT or DELETE requests to the credentials endpoint that may indicate exploitation.
• Rotate any credentials or private keys that were stored in the affected credential store immediately.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-87689?

The National Vulnerability Database rates the vulnerability as Critical with a CVSS score of 9.8.

Which versions of Metasploit Framework are vulnerable?

All published versions of the Metasploit Framework up to and including 6.5.4 are affected.

Is there a patch available for this vulnerability?

Yes, the issue is fixed in Metasploit Framework version 6.5.5 by adding authentication checks to the relevant handlers.