Unauthenticated User Creation in Rapid7 Metasploit Framework

CVE-2026-121139

What is CVE-2026-121139?

The Rapid7 Metasploit Framework's REST API is vulnerable due to a flawed authentication process allowing an unauthenticated caller to create users, including administrators, when the users table is empty. This occurs because the endpoint POST /api/v1/users bypasses authentication during the initial setup phase, enabling a security risk where malicious actors can exploit this access point to gain administrative privileges. The vulnerability was effectively addressed in version 6.5.9.

References