Metasploit Framework Critical Auth Bypass CVE-2026-87689 Fixes in v6.5.5

The Metasploit Framework Web Service contains a critical security flaw that allows any network client to manipulate credential data without authentication. The National Vulnerability Database assigned CVE-2026-87689 a CVSS score of 9.8, classifying the issue as critical. The vulnerability exists within the REST API component known as msf-ws, specifically in the Msf::WebServices::CredentialServlet.

The risk

The core issue is a missing authentication check in specific API handlers. According to the NVD record, every mutating and read route in the servlet calls warden.authenticate! before processing a request. However, the update_credential (PUT) and delete_credentials (DELETE) handlers for the /api/v1/credentials endpoint omit this call entirely. This deviation from the standard security pattern leaves these specific actions exposed.

Because these handlers call directly into the lib/msf/core/db_manager/cred.rb library, which performs no authorization checks of its own, the system trusts the request implicitly. Any client that can reach the web service on its default 0.0.0.0:8080 listener can execute these commands. The attacker does not need to present any credentials or tokens to perform these actions.

An unauthenticated user can read, modify, or permanently delete every stored credential record in the database. This includes sensitive data such as passwords, hashes, and private keys that may be stored for shared team engagements. The source material states that these actions can be performed without presenting any authentication.

Who is exposed

All published versions of the Metasploit Framework through 6.5.4 are affected by this vulnerability. The Rapid7 product is identified in the source material as the affected software. Organizations that host the Metasploit Web Service internally or in cloud environments are exposed if the service is reachable by unauthorized networks.

The default configuration listens on 0.0.0.0:8080, which binds to all available network interfaces. If the service is exposed to the internet or an untrusted internal network segment, any host can attempt to exploit the flaw. Users running older versions of the framework are at immediate risk until they upgrade.

Cost and compliance

What to do and how to stay safe

• Severity scores alone ignore your specific environment and asset value.
• Contextual data like internet exposure changes the urgency of a flaw.
• Manual review of scan results prevents alert fatigue and wasted effort.

Fix the holes that attackers can actually reach, not just the ones with the highest scores. Start by patching internet-exposed systems with known exploit code today.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.