Metasploit Web Service Lets Anyone Delete Stored Credentials

The short version

• The Metasploit Framework Web Service has a critical authentication bypass flaw
• Attackers can access the credential store without any login credentials
• The issue impacts all versions of the framework prior to 6.5.5

The details

The Metasploit Framework Web Service REST API contains a severe authentication bypass vulnerability, identified as CVE-2026-87689. According to the National Vulnerability Database, this flaw allows any client that can reach the service to manipulate the credential store. The web service typically listens on 0.0.0.0:8080 by default, making it accessible to anyone on the network who can connect to that port.

The vulnerability exists within the Msf::WebServices::CredentialServlet component. While most routes in this servlet require authentication via warden.authenticate!, the handlers for updating and deleting credentials omit this check. This inconsistency means that PUT requests to update credentials and DELETE requests to remove them are processed without verifying the user's identity. Consequently, an attacker can permanently delete or modify every stored credential record, including passwords, hashes and private keys.

This issue affects all published versions of the Metasploit Framework through 6.5.4. The flaw is classified as critical with a CVSS score of 9.8. It stems from CWE-306, which relates to missing authentication for critical functions. The underlying database manager library does not perform its own authorization checks, relying entirely on the web service layer to validate requests.

The context

Rapid7 addressed this issue in version 6.5.5 of the Metasploit Framework. The fix involves adding the warden.authenticate! call as the first statement in both the update and delete handlers. This change aligns these specific routes with the security pattern used by every other route in the API, ensuring that all mutating and read operations require valid authentication before processing.

The exposure of shared team engagement data is particularly risky because credentials stored in the framework often include high-value assets like private keys. Without authentication, an unauthorised actor could erase this data, disrupting security operations and potentially covering their tracks by deleting evidence of access.

Next steps

Users running Metasploit Framework should verify their current version immediately. If the version is 6.5.4 or earlier, they are vulnerable to this unauthenticated access flaw. Upgrading to version 6.5.5 or later is the only confirmed remediation. Teams should also review their network configurations to ensure the web service port is not exposed to untrusted networks.

What to do and how to stay safe: Metasploit Framework

• Check your Metasploit Framework version and upgrade to 6.5.5 or later if you are running an affected version
• Restrict network access to the Metasploit Web Service port 8080 to trusted internal hosts only
• Monitor logs for unexpected PUT or DELETE requests to the /api/v1/credentials endpoint
• Audit stored credentials for signs of tampering or deletion after upgrading the framework

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Metasploit are affected by CVE-2026-87689?

All published versions of the Metasploit Framework through 6.5.4 are affected by this vulnerability.

Can an attacker read credentials without authentication?

Yes, the flaw allows any client to read, modify or delete credential records without presenting authentication.

Is there a fix available for this issue?

Yes, Rapid7 released version 6.5.5 which adds the required authentication check to the affected handlers.