External risk intelligence

Metasploit Framework REST API Unauthenticated Credential Access

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-87689

The Metasploit Framework Web Service REST API is a tool for security professionals and penetration testers, not a general-purpose public-facing web application. While the service listens on 0.0.0.0 by default, it is typically deployed within controlled internal laboratory or development environments rather than exposed directly to the public internet in standard deployment patterns.

Missing Authentication

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Metasploit Framework Web Service REST API could allow unauthenticated access to sensitive stored information, such as passwords and private keys. While Metasploit is a tool for security professionals, its default configuration could potentially expose these credentials if not properly secured. The main concern is confirming the relevance and exposure of this tool within your environment.

API allows access to stored secrets.
Protects sensitive team engagement data.
Confirm Metasploit deployment and security.

Attack Path

How an attacker could exploit the issue

An attacker can directly interact with the Metasploit Framework's web service API without any authentication. By sending specific requests to the API's credential endpoints, an attacker can access, alter, or delete all stored sensitive information, such as passwords, hashes, and private keys. This could lead to a complete compromise of the engagement's security data.

Unauthenticated network access required.
Update and delete credential API calls.
Full credential data exposure and modification.

Live Threat

Current exploitation, exposure, and threat context

The Metasploit Framework Web Service REST API, when exposed externally and unauthenticated, could allow any attacker to access, modify, or delete all stored credentials. This includes sensitive data such as passwords, password hashes, and private keys, potentially compromising shared team engagements.

Stored team engagement credentials.
Unauthenticated API access to handlers.
Compromise of sensitive stored data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Metasploit Framework's REST API is susceptible to a critical vulnerability, allowing unauthenticated access to stored credentials. The primary responsibility for addressing this lies with the teams managing the Metasploit Framework, likely security operations or penetration testing teams. The first practical step is to identify all instances of the Metasploit Framework Web Service, confirm their accessibility, and determine the business criticality of the data stored within. Once identified and prioritized, remediation planning should occur, potentially involving coordination with vendor management if using a managed service.

Identify Metasploit Framework instances and exposure.
Verify credential store access and data sensitivity.
Plan and coordinate remediation with owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Metasploit Framework and why does it have an API?

Metasploit Framework is a widely used penetration testing platform that helps security professionals develop and execute exploits against systems. It includes a Web Service REST API (msf-ws) to allow teams to programmatically manage tasks, such as tracking project data and sensitive information like passwords, hashes, and private keys required for their engagements.

How does CWE-306 affect Metasploit in CVE-2026-87689?

This CVE involves a Missing Authentication for Critical Function (CWE-306). While most API routes correctly enforce authentication, the update and delete handlers for the credentials endpoint bypass this check entirely. Consequently, the API fails to verify the identity of anyone sending a request, allowing unauthorized users to interact with sensitive credential records as if they were authorized administrators.

Do I need to authenticate to trigger this vulnerability?

No. The vulnerability exists specifically because the credential update and delete handlers lack the authentication logic present in the rest of the API. An attacker does not need to provide a username, password, or token to execute these requests. However, the attacker must have network reachability to the service, which listens on the 0.0.0.0:8080 interface by default.

Is my Metasploit instance at risk according to Halo Surface Signal?

While the API listens on 0.0.0.0 by default, Halo Surface Signal notes that Metasploit is typically used in controlled laboratory or internal development environments rather than being exposed to the public internet. The primary risk is to instances that are inadvertently placed on reachable networks or misconfigured to be accessible outside of a secure, internal team environment.

How can I secure my environment against this credential access?

The most effective step is to update the Metasploit Framework to version 6.5.5 or later, which restores the required authentication checks for all API handlers. Before updating, security teams should identify all active instances of the framework, verify if they are accessible on the network, and ensure that access to the web service is restricted to trusted hosts only.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.