Organisations Urged to Patch Metasploit v6.5.5 After Critical Auth Bypass Exposes Private Keys and Credentials

Organisations relying on the Metasploit Framework for security testing face a severe data exposure risk due to a critical authentication bypass. The flaw allows any network-accessible client to manipulate the central credential store without providing valid login details. This includes the ability to permanently delete sensitive records such as passwords, hashes, and private keys used for shared team engagements.

The issue stems from missing security checks within the web service component of the framework. According to the National Vulnerability Database record for CVE-2026-87689, the REST API exposes the credential store through a specific servlet. While most routes require authentication, two key handlers for updating and deleting credentials omit this step entirely, creating a high-severity gap in the security posture.

What we know

The Metasploit Framework Web Service REST API, known as msf-ws, manages access through the Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet typically calls warden.authenticate! before processing a request. However, the update_credential handler for PUT requests and the delete_credentials handler for DELETE requests on the /api/v1/credentials endpoint skip this authentication call.

Because these specific handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no independent authorization check, the system fails to verify user identity. Any client able to reach the web service on its default listener at 0.0.0.0:8080 can interact with the database. This allows an attacker to read, modify, or permanently delete every stored credential record without presenting any authentication.

All published versions of the Metasploit Framework through 6.5.4 are affected by this configuration error. The flaw is classified as critical with a CVSS score of 9.8. It is categorised under weakness CWE-306, which relates to incorrect default permissions. The vulnerability enables unauthenticated access to sensitive data, potentially compromising ongoing security assessments and shared team environments.

Rapid7 addressed the issue in version 6.5.5 of the framework. The fix involves adding warden.authenticate! as the first statement in both the update and delete handlers. This change aligns these specific routes with the security pattern used by every other route in the API, ensuring that all requests are properly authenticated before processing.

Defender's checklist

• Verify the current version of the Metasploit Framework installed on all systems.
• Check if the web service is listening on the default 0.0.0.0:8080 port.
• Review access logs for unauthenticated PUT or DELETE requests to /api/v1/credentials.
• Confirm that all instances have been updated to version 6.5.5 or later.

What to do and how to stay safe: Metasploit Framework

• Audit network configurations to ensure the Metasploit web service is not exposed to untrusted networks.
• Restrict access to the 0.0.0.0:8080 listener using firewall rules to trusted IP addresses only.
• Monitor server logs for unusual activity related to credential modification or deletion endpoints.
• Once the vendor provides an update, apply patch 6.5.5 immediately to restore authentication controls.

Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Metasploit are vulnerable to CVE-2026-87689?

All published versions of the Metasploit Framework through 6.5.4 are affected by this critical authentication bypass flaw.

How can an attacker exploit this vulnerability?

An attacker can send unauthenticated PUT or DELETE requests to the /api/v1/credentials endpoint to read, modify, or delete stored credentials.

Is there a fix available for this issue?

Yes, Rapid7 released version 6.5.5 which adds the necessary authentication checks to the affected handlers.