CVE-2026-121139: Rapid7 Metasploit msf-ws missing authentication in bootstrap

CVE-2026-121139 · Severity: info · Published 2026-11-05

Rapid7 Metasploit's msf-ws REST API had a design flaw where the first administrator account could be created without authentication when the user database was empty. An attacker with network access to the API could create an administrative account and gain complete control of the penetration testing platform without needing any credentials, potentially compromising all systems that the framework targets.

Vendors: Rapid7.

Quick answers

Is CVE-2026-121139 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-121139 being exploited in the wild.
How severe is CVE-2026-121139?
Informational severity, published 5 November 2026.
Which products and versions are affected?
Rapid7 Metasploit before 6.5.9.
Is there a fix for CVE-2026-121139?
Yes: fixed in 6.5.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121139 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-121139?
Check whether you run Rapid7 Metasploit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 6.5.9

Technical details

The vulnerability exists in the API token authentication strategy (ApiToken#authenticate!), which short-circuits to return success when msf.auth_initialized is false, bypassing the AdminApiToken administrator check. The POST /api/v1/users endpoint was unintentionally exempt from authentication during bootstrap—when the users table is empty—allowing unauthenticated account creation. This was fixed by moving first-user setup into msfdb before the web service starts, requiring an administrator token for all user creation requests regardless of database state.

Affected products

  • Rapid7 Metasploit before 6.5.9

Timeline

  • 2026-11-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.