Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-87689— Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints

Quick assessment

Affected
Rapid7 Metasploit Framework
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Metasploit Framework Web 服务 REST API（msf-ws）通过 Msf::WebServices::CredentialServlet 暴露了凭据存储。该 Servlet 中所有处理修改和读取请求的路由在处理请求前都会调用 warden.authenticate! 进行身份验证，但 /api/v1/credentials 端点对应的 update_credential（PUT）和 delete_credentials（DELETE）处理程序完全省略了该身份验证调用。由于这些处理程序直接

CVSS 9.8 · Critical EPSS 0.37% · P29

Possible ATT&CK Techniques 1 AI

T1552 · Unsecured Credentials

Affected Version Matrix 2

VendorProduct Version RangeStatus
Rapid7 Metasploit Framework ≤ 6.5.4 affected
6.5.5 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-87689

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints
Source: CVE Program / CVE List V5
Vulnerability Description
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Rapid7 Metasploit Framework 0 ~ 6.5.4 -

II. Public POCs for CVE-2026-87689

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-87689

请登录查看更多情报信息。

Proof of Concept for CVE-2026-87689 (2)

IV. Related Vulnerabilities

Same product: Metasploit Framework
Same vendor: Rapid7
Same weakness: CWE-306

V. Comments for CVE-2026-87689

No comments yet

Leave a comment