CVE-2026-87689 Rapid7 CVE debrief

Who should care

Rapid7 Metasploit Framework users, security teams, and administrators responsible for managing and securing the Metasploit Framework installation should verify and apply the patch to prevent potential credential exposure and unauthorized modifications. They should also review compensating controls for exposed systems and monitor for unauthorized access to credential data.

Why it matters

CVE-2026-87689 allows unauthorized access to Metasploit Framework credential data due to missing authentication in the Web Service REST API. Users should verify and apply the patch to prevent potential credential exposure and unauthorized modifications.

• Potential unauthorized access to sensitive credential data.
• Possible modification or deletion of credential records.
• Risk of privilege escalation or lateral movement.
• Need for verification of Metasploit Framework version and patch application.

Technical summary

The Metasploit Framework Web Service REST API exposes credential store through Msf::WebServices::CredentialServlet. Two handlers, update_credential and delete_credentials, omit authentication calls, allowing unauthorized access to credential data. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API. This fix prevents unauthorized access to sensitive credential data and ensures proper authentication for all credential-related operations.

Defensive priority

Rapid7 Metasploit Framework users should verify and apply the patch to prevent unauthorized access to credential data.

Recommended defensive actions

• Verify the Metasploit Framework version and apply the patch to version 6.5.5 if currently using a version less than or equal to 6.5.4.
• Restrict access to the Metasploit Framework Web Service REST API to authorized users.
• Monitor for unauthorized access to credential data.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability in Metasploit Framework's Web Service REST API. The issue allows unauthenticated access to credential data. Users should verify and apply the patch to prevent potential credential exposure and unauthorized modifications. The vulnerability affects Metasploit Framework users, security teams, and administrators responsible for managing and securing the Metasploit Framework installation. The fix involves adding warden.authenticate! as the first statement in both handlers,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.