Vulnerabilities · 9h ago

Metasploit API bug exposed saved credentials

Rapid7 says Metasploit Framework Web Service exposed its credential store through two REST API routes, and all published versions through 6.5.4 are affected by CVE-2026-87689. On the default 0.0.0.0:8080 listener, an unauthenticated client could read, change, or delete every stored credential record.

The flaw is simple: most msf-ws routes call the login check before they do anything, but the update and delete handlers for /api/v1/credentials did not. Those handlers went straight into the database layer, which does no authorization of its own, so the service treated any network client as if it were an operator and exposed passwords, hashes, and private keys.

For teams running shared Metasploit instances, the exposure is not just one saved secret but the whole engagement credential store behind that listener. After the fix in 6.5.5, any environment that left msf-ws reachable still needs to treat the credential database as compromised if an untrusted client could reach it.

CVE-2026-87689

NVD KEV

CVSS 9.8 CRITICAL: the Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet.

Timeline

Oct 13 Reported by CVE Program records

Sources

1 source covering this story

CVE Program records Oct 13
Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints

Entities

CVE-2026-87689

Part of the PlainSec briefing for 2026-10-13

Editions

Briefing for 2026-10-13

Vulnerabilities · 9h agoMetasploit API bug exposed saved credentialsRapid7 says Metasploit Framework Web Service exposed its credential store through two REST API routes, and all published versions through 6.5.4 are affected by CVE-2026-87689. On the default 0.0.0.0:8080 listener, an unauthenticated client could read, change, or delete every stored credential record.The flaw is simple: most msf-ws routes call the login check before they do anything, but the update and delete handlers for /api/v1/credentials did not. Those handlers went straight into the database layer, which does no authorization of its own, so the service treated any network client as if it were an operator and exposed passwords, hashes, and private keys.For teams running shared Metasploit instances, the exposure is not just one saved secret but the whole engagement credential store behind that listener. After the fix in 6.5.5, any environment that left msf-ws reachable still needs to treat the credential database as compromised if an untrusted client could reach it.