Executive brief
Metasploit Framework's JSON-RPC web service has a logic flaw that can reset authentication state when the database health check fails and the API token environment variable is not configured. This allows attackers with local access to bypass authentication and interact with the JSON-RPC interface without valid credentials, potentially gaining control over penetration testing operations.
Technical details
The vulnerability is a fail-open authentication bypass in the JSON-RPC web service interface triggered by a logic error in exception handling. When the db.check database health check throws an exception and the MSF_WS_JSON_RPC_API_TOKEN environment variable is not set, the application incorrectly resets the msf.auth_initialized flag to false. The ApiToken Warden authentication strategy interprets this false value as indicating authentication is not yet initialized, thereby granting unauthenticated access to the JSON-RPC dispatcher. The attack requires local access to the Metasploit service. A patch was merged on August 13, 2026 that corrects the authentication logic to properly handle this exception case.
Affected products
- Rapid7 Metasploit Framework
Timeline
- 2026-08-27: disclosed
- 2026-08-13: patched