CVE-2026-109682 Rapid7 CVE debrief

Who should care

Operators and administrators of Metasploit Framework, especially those managing versions before 6.5.7, should assess their exposure and prioritize verification and remediation efforts to address potential SSRF vulnerabilities.

Why it matters

CVE-2026-109682 is a medium-severity vulnerability in Metasploit Framework that allows SSRF attacks. Operators and administrators should assess exposure, prioritize verification and remediation efforts, and consider security testing workflows.

• Potential SSRF attacks on internal services not otherwise accessible to attackers.
• Possible unauthorized requests to arbitrary HTTP services within the operator's network.
• Need for verification of inventory and upgrade to version 6.5.7 or later.
• Potential impact on security testing and penetration testing workflows.

Technical summary

The Metasploit Framework is vulnerable to Server-Side Request Forgery (SSRF) attacks due to unrestricted redirect destinations in HTTP requests made through send_request_cgi!. This issue affects versions before 6.5.7 and could allow attackers to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker. The vulnerability is caused by the lack of restrictions on redirect destinations, allowing malicious HTTP servers to cause the system running Metasploit to make requests to arbitrary HTTP services. Operators and administrators of Metasploit Framework should assess exposure and prioritize verification of their 6.5.

Defensive priority

Operators and administrators of Metasploit Framework should assess exposure and prioritize verification of their inventory, focusing on versions before 6.5.7, to address potential SSRF vulnerabilities.

Recommended defensive actions

• Confirm whether affected Metasploit Framework deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Inventory check: Identify and list all instances of Metasploit Framework versions before 6.5.7.

Evidence notes

The CVE record and source item provide details on the vulnerability in Metasploit Framework versions before 6.5.7, which allows HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. This could lead to SSRF attacks, but specific exploitation details are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.