CVE-2026-109682: Metasploit Framework HTTP Redirect Server-Side Request Forgery
Metasploit Framework versions before 6.5.7 allow HTTP requests made through sendrequestcgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Metasploit Frameworkto a version that resolves this vulnerability.Fixed in 6.5.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
Operators running Metasploit Framework versions earlier than 6.5.7 are exposed when they use send_request_cgi! against a malicious HTTP server. The resulting requests originate from the operator's network and may reach internal HTTP services inaccessible to the remote attacker.
What does an attacker need to exploit it?
The attacker needs to control, or cause Metasploit to contact, an HTTP server that returns a redirect. No Metasploit authentication or operator privilege beyond using the affected request functionality is described.
Are internal-only services at risk?
Yes. A malicious redirect can cause the Metasploit host to request arbitrary HTTP services reachable from the operator's network, including internal services.
What is the available remediation?
Upgrade Metasploit Framework to version 6.5.7 or later. The issue affects versions before 6.5.7.