HTTP Request Vulnerability in Metasploit Framework by Rapid7
CVE-2026-109682

4.7MEDIUM

Key Information:

Vendor

Rapid7

Status
Metasploit Framework
Vendor
CVE Published:
20 October 2026

What is CVE-2026-109682?

The Metasploit Framework has a vulnerability that allows HTTP requests made through the send_request_cgi! method to follow unrestricted redirects to alternate hosts. This can enable attackers controlling a malicious HTTP server to manipulate the system into making requests to arbitrary HTTP services that may be reachable within the operator's network, including internal services. As a result, sensitive services that are not typically exposed to external networks could become accessible to an attacker, heightening potential security risks.

Affected Version(s)

Metasploit Framework Windows 0 < 6.5.7

References

https://github.com/rapid7/metasploit-framework/pull/21979
patchrelease-notes

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adiel Sol, Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel, Shir Sadon DREAM Security Research Team
.