Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Rapid7 Metasploit Framework has a CVSS 9.8 auth bypass (CVE-2026-87689). The msf-ws REST API skips authentication on the PUT and DELETE handlers for /api/v1/credentials. It listens on 0.0.0.0:8080 by default, so anyone who can reach it can modify or delete stored credentials. All versions through 6.5.4 are affected. Fixed in 6.5.5. Details: http://vulntracker.io/cves/CVE-2026-87689 #Metasploit #Rapid7 #InfoSec #CVE
🚨 CVE-2026-87689 (CVSS 9.8 Critical) Metasploit Framework Web Service omits authentication on REST API routes, allowing unauthenticated attackers to read, modify, or delete all stored team credentials. https://www.thehackerwire.com/vulnerability/CVE-2026-87689/ https://t.co/4gG9FALDcd