Key points
- CVE-2026-87689 affects all Metasploit Framework versions up to 6.5.4.
- The bug allows unauthenticated users to modify or delete credential records.
- Rapid7 released version 6.5.5 to fix the authentication bypass.
The Metasploit Framework Web Service contains a severe security flaw that allows attackers to access sensitive data without providing any login credentials. This issue, tracked as CVE-2026-87689, is rated critical with a CVSS score of 9.8. It affects every version of the software released prior to 6.5.5.
In plain English
Normally, software requires you to prove who you are before letting you change important data. In this case, the web service failed to check for that proof on two specific actions: updating and deleting credentials. Because of this missing check, anyone who can connect to the service’s default port can view, alter, or permanently erase stored passwords, hashes, and private keys.
The background
The vulnerability exists within the Msf::WebServices::CredentialServlet component of the Metasploit Framework. While most routes in this servlet correctly require authentication, the handlers for the PUT and DELETE methods on the credentials API endpoint skipped this step. This omission allowed direct access to the underlying database manager, which also performed no additional authorization checks.
What changes now
Rapid7 has addressed the issue by releasing Metasploit Framework version 6.5.5. The update adds the required authentication call to the beginning of both the update and delete handlers. This change aligns these specific routes with the security pattern used by every other part of the web service API, ensuring users must authenticate before performing these actions.
What to do and how to stay safe: Metasploit Framework
- Verify your Metasploit Framework version immediately and upgrade to 6.5.5 or later if you are running an older release.
- Review network logs for any unauthorized connections to port 8080, particularly looking for PUT or DELETE requests to the credentials API endpoint.
- Rotate any credentials, passwords, or private keys that were stored in the affected Metasploit database to ensure they remain secure.
- Restrict network access to the Metasploit Web Service so that only trusted internal systems can reach the default listener address.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Metasploit are affected by this vulnerability?
All published versions of the Metasploit Framework through version 6.5.4 are affected by CVE-2026-87689.
Is there a patch available for this issue?
Yes, Rapid7 has released version 6.5.5 which fixes the authentication bypass in the web service.
What data is at risk from this flaw?
Attackers can read, modify, or delete stored credential records, including passwords, hashes, and private keys.
