CVE-2026-87689
CVSS 9.8 CRITICAL: the Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet.
Vulnerabilities & Exploits
Rapid7 says Metasploit Framework Web Service exposed its credential store through two REST API routes, and all published versions through 6.5.4 are affected by CVE-2026-87689. On the default 0.0.0.0:8080 listener, an unauthenticated client could read, change, or delete every stored credential record.
The flaw is simple: most msf-ws routes call the login check before they do anything, but the update and delete handlers for /api/v1/credentials did not. Those handlers went straight into the database layer, which does no authorization of its own, so the service treated any network client as if it were an operator and exposed passwords, hashes, and private keys.
For teams running shared Metasploit instances, the exposure is not just one saved secret but the whole engagement credential store behind that listener. After the fix in 6.5.5, any environment that left msf-ws reachable still needs to treat the credential database as compromised if an untrusted client could reach it.
1 source · 10h ago
CVSS 9.8 CRITICAL: the Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet.
CVE Program records
Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints
originalPart of the PlainSec briefing for 2026-10-13
Every edition of this story: Metasploit API bug exposed saved credentials