CVE-2026-87689: Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the updatecredential (PUT) and deletecredentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/dbmanager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Metasploit Frameworkto a version that resolves this vulnerability.Fixed in 6.5.5
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated access?
Any affected msf-ws instance reachable by a client is exposed because the service listens on 0.0.0.0:8080 by default. Network reachability to that listener is the only stated prerequisite; no authentication or user interaction is required.
What can an unauthenticated attacker do through the affected endpoints?
An attacker can read, modify, or permanently delete all credential records in the credential store. This can include stored passwords, hashes, and private keys from shared engagement data.
Are default installations affected?
Yes. The affected service's default listener is 0.0.0.0:8080, so a default deployment is exposed if that port is reachable by untrusted clients.
What mitigation is available if an immediate upgrade is not possible?
Restrict network access to the msf-ws listener so untrusted clients cannot reach it. The vulnerability requires access to the web service, so limiting exposure of port 8080 reduces the attack surface.
How can teams determine whether they need to remediate?
Metasploit Framework versions through 6.5.4 are affected. Version 6.5.5 adds authentication checks to the vulnerable PUT and DELETE credential handlers.