Unauthorized Credential Access in Metasploit Framework Web Service

CVE-2026-87689

What is CVE-2026-87689?

The Metasploit Framework Web Service REST API experiences a significant authorization bypass vulnerability in its credential management functionality. Specifically, the update_credential and delete_credentials handlers fail to invoke the necessary authentication checks, allowing malicious clients to authenticate silently and gain unrestricted access to sensitive stored credentials. This flaw permits the unauthorized reading, modification, or deletion of credential records, which can include critical data such as passwords and private keys. The issue affects all versions up to 6.5.4 but has been addressed in version 6.5.5 where authentication checks have been correctly implemented for all API routes.

References