Metasploit Framework Web Service: Missing authentication in credential API
Summary
The Metasploit Framework web service (msf-ws) REST API has two credential endpoints, PUT and DELETE on /api/v1/credentials, that do not call the authentication check. Any client that can reach the default 0.0.0.0:8080 listener can read, modify or permanently delete all stored credentials, including passwords, hashes and private keys kept for shared team engagements. No credentials are required, and the CVSS score is 9.8 (critical).
Affected
- Metasploit Framework 0 through 6.5.4
- Whether the 6.4.x maintenance branch is affected is unknown.
Fixed in
- Metasploit Framework 6.5.5 adds the authentication check to both handlers.
Workaround
- No vendor workaround published.
- Bind msf-ws to localhost only, or block TCP 8080 on host and network firewalls.
- Do not run msf-ws on shared or internet-facing hosts until patched.
Exploitation
- No public proof of concept found at the time of research.
- No evidence of exploitation in the wild found; CISA SSVC lists exploitation as none.
- CISA KEV status was not verified.
Our recommendation
- Upgrade to Metasploit Framework 6.5.5 or later, and check whether 6.4.x is affected by asking Rapid7.
- Check whether port 8080 of any msf-ws host is reachable from untrusted networks.
- If exposure is possible, rotate all credentials stored in the Metasploit database.
- Restrict msf-ws to dedicated, access-controlled systems.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Metasploit Framework GitHub repository github.com
- Metasploit Framework 6.5.5 release github.com
- Vulners: RAPID7:CVE-2026-87689 vulners.com
- CVE-2026-87689 record mirror (threatint) cve.threatint.com
- TheHackerWire: CVE-2026-87689 unauthenticated credential exposure www.thehackerwire.com
- Strix: CVE-2026-87689 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:07.
Original description (NVD)
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API.
NVD references (9)
- https://github.com/rapid7/metasploit-framework
- https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5
- https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5
- https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5
- https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5
- https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5
- https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5
- https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5
- https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.