CVE-2026-16895: Authentication Bypass in Metasploit JSON-RPC Service When DB Health Check Fails
A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check (db.check) and the environment variable MSFWSJSONRPCAPITOKEN is not explicitly set, the application resets the internal state flag msf.authinitialized to false. The ApiToken Warden authentication strategy misinterprets this false value as an indicator that authentication is not initialized or required, thereby granting unauthenticated local access to the JSON-RPC request dispatcher.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated access?
The condition applies to the Metasploit JSON-RPC web service when a database health-check exception occurs and MSF_WS_JSON_RPC_API_TOKEN is not explicitly set. The resulting access is described as local access to the JSON-RPC request dispatcher.
What must occur for the authentication bypass to be triggered?
An exception must occur during the db.check database health check while MSF_WS_JSON_RPC_API_TOKEN is unset. This resets msf.auth_initialized to false, which the ApiToken Warden strategy treats as authentication not being required.
What configuration change can prevent the described fail-open path?
Explicitly set the MSF_WS_JSON_RPC_API_TOKEN environment variable. The described bypass condition depends on that variable not being explicitly configured.