‹ Back to list

CVE-2026-87689

Status: Awaiting AnalysisCritical (9.8)—
Severity9.8Critical · CVSS 3.1
Exploitation probability0.37 %higher than 29% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

News and reports on Orbitaley

The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely.

Read full descriptionShow less

Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API.

CVSS

Base score
9.8
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.37 %
Percentile among all scored CVEs
29
Score date
10/21/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

API REST sin autenticación en rutas PUT/DELETE permite acceso no autorizado a credenciales (contraseñas, hashes, claves privadas). AV:N, PR:N, UI:N confirma T1190. Impactos: acceso con credenciales ajenas (T1078), lectura de datos sensibles (T1005), modificación/eliminación de credenciales (T1565.00

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Rapid7 — Metasploit FrameworkAI

CWEs

References

Show 9 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-87689",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-87689",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-14T03:59:13.035893Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@rapid7.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@rapid7.com",
      "affectedData": [
        {
          "repo": "https://github.com/rapid7/metasploit-framework",
          "vendor": "Rapid7",
          "product": "Metasploit Framework",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "6.5.4"
            },
            {
              "status": "unaffected",
              "version": "6.5.5",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Linux",
            "Windows",
            "macOS"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-13T01:16:47.110",
  "references": [
    {
      "url": "https://github.com/rapid7/metasploit-framework",
      "source": "cve@rapid7.com"
    },
    {
      "url": "https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5",
      "source": "cve@rapid7.com"
    },
    {
      "url": "https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5",
      "source": "cve@rapid7.com"
    },
    {
      "url": "https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5",
      "source": "cve@rapid7.com"
    },
    {
      "url": "https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5",
      "source": "cve@rapid7.com"
    },
    {
      "url": "https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5",
      "source": "cve@rapid7.com"
    },
    {
      "url": "https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5",
      "source": "cve@rapid7.com"
    },
    {
      "url": "https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5",
      "source": "cve@rapid7.com"
    },
    {
      "url": "https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5",
      "source": "cve@rapid7.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@rapid7.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API."
    }
  ],
  "lastModified": "2026-10-16T19:55:59.740",
  "sourceIdentifier": "cve@rapid7.com"
}