⚠️ NEW METASPLOIT FLAW — A DATABASE ERROR CAN MAKE JSON-RPC AUTHENTICATION FAIL OPEN CVE-2026-16895 affects Metasploit Framework versions before 6.5.2 and can grant unauthenticated local access to the JSON-RPC request dispatcher under a specific failure condition. CyberSignal Priority: 🟡 MEDIUM 📅 August 27, 2026 🆔 CVE-2026-16895 🏷️ Metasploit · Authentication Bypass · JSON-RPC Rapid7 disclosed an interesting logic flaw in Metasploit’s JSON-RPC web service. The vulnerable sequence is: db.check throws an exception ↓ API token environment variable is not explicitly set ↓ msf.auth_initialized becomes false ↓ authentication logic interprets that as: authentication is not required Instead of denying access. The result is unauthenticated access to the local JSON-RPC dispatcher. ⚠️ Important context This is not an internet-facing pre-auth RCE. Rapid7 scores it: CVSS 4.0: 5.1 — MEDIUM and classifies the attack vector as LOCAL. So the real risk is much narrower than “Metasploit remotely hacked.” But the security-design lesson is valuable: an internal error should never silently weaken authentication. 🛡️ Defender action Organizations using the affected JSON-RPC service should: • update to Metasploit Framework 6.5.2+ • verify API-token configuration • restrict access to RPC interfaces • monitor unexpected local JSON-RPC activity Security controls should fail toward denial — not permission. FAIL-CLOSED IS A SECURITY PROPERTY. FAIL-OPEN IS AN ATTACK PATH. Sources: Rapid7 · CVE
Post summary
The post reports a local authentication bypass in Metasploit caused by a DB error, provides a CVSS score, and recommends updating to 6.5.2+ with configuration and access controls to mitigate the issue.