Critical flaw in the Metasploit Framework web service allows credential theft and deletion without authentication
The REST API of the Metasploit Framework web service (msf-ws) fails to check authentication on two credential-store routes, allowing anyone with network access to read, modify or delete passwords, hashes and private keys. All versions up to 6.5.4 are affected; the fix is in 6.5.5.
What happened
A new vulnerability, CVE-2026-87689, has been published with a CVSS score of 9.8 out of 10 (critical). It affects the web service component (msf-ws) of Metasploit Framework, Rapid7's penetration testing tool.
According to the published description, the REST API exposes the credential store through the CredentialServlet component. Every route in that servlet verifies the caller's identity before processing a request, except two: the update (PUT) and delete (DELETE) handlers for /api/v1/credentials, which skip the authentication call entirely. These handlers go straight to the database layer, which performs no authorisation check of its own.
As a result, any client able to reach the web service — which by default listens on 0.0.0.0:8080, that is, on all network interfaces — can read, modify or permanently delete every stored credential record, including passwords, hashes and private keys saved for a shared team engagement, without presenting any credentials.
Who is affected
The issue affects all published versions of Metasploit Framework up to and including 6.5.4, wherever the msf-ws web service is in use.
The risk is highest for offensive security teams (red teams, auditors, penetration testers) sharing a single Metasploit instance, because the credential store typically holds live access material belonging to client environments. Theft or tampering would have a direct impact on third parties, with legal and contractual consequences.
- Metasploit Framework, all versions up to and including 6.5.4.
- Deployments with the web service (msf-ws) enabled, particularly where it is reachable from the internal network or the internet.
Exploitation status
The vulnerability is not listed in CISA's KEV catalogue, so there is no confirmed active exploitation, and no public exploit code is known. FIRST has not yet assigned an EPSS score to this CVE.
Even so, the severity is at the top of the scale: the attack is carried out over the network, with no authentication and no user interaction, and the logic of the flaw is straightforward to reproduce from the public description.
What to do
A fix is already available. According to the release published in Rapid7's repository, version 6.5.5 resolves the issue by adding the authentication check as the first statement in both handlers, matching the pattern used by every other route in the API.
- Upgrade Metasploit Framework to version 6.5.5 or later.
- Until you can upgrade, do not expose msf-ws on 0.0.0.0: bind the listener to localhost, or restrict access to port 8080 with firewall rules or access control lists.
- Check whether the web service has been reachable from untrusted networks and, if so, review logs for PUT or DELETE requests to /api/v1/credentials.
- If unauthorised access is suspected, treat all stored credentials as compromised and rotate them with the affected clients or systems.
- Verify the integrity of the credential store: the flaw also allows records to be modified or deleted, not just read.
Sources
Affected technologies
Vulnerabilities (1)
| CVE | Severity | Active exploitation | Published | NVD status |
|---|---|---|---|---|
| CVE-2026-87689 | Critical (9.8) | — | 10/12/2026 | Awaiting Analysis |
Written automatically from NVD, CISA KEV and vendor advisory data. Always check affected versions and patches in the vendor's official advisory before acting.