Is CVE-2026-87689 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87689 being exploited in the wild.

How severe is CVE-2026-87689?

Critical severity, with a CVSS score of 9.8, published 13 October 2026.

Which products and versions are affected?

Rapid7 Metasploit Framework 6.5.4 and earlier.

Is there a fix for CVE-2026-87689?

Yes: fixed in 6.5.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-87689 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-87689?

Check whether you run Rapid7 Metasploit Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87689: Metasploit Framework authentication bypass in credential REST API

CVE-2026-87689 · Severity: critical · CVSS 9.8 · Published 2026-10-13

Metasploit Framework's web service REST API fails to authenticate certain credential management requests, allowing anyone with network access to read, modify, or delete stored passwords, private keys, and hashes used by security teams. An attacker who can reach the default listener at 0.0.0.0:8080 can steal or sabotage credentials without providing any authentication, leading to compromise of systems targeted during penetration tests or red team exercises.

Technologies: Rapid7 Metasploit Framework. Vendors: Rapid7.

Quick answers

Is CVE-2026-87689 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87689 being exploited in the wild.
How severe is CVE-2026-87689?: Critical severity, with a CVSS score of 9.8, published 13 October 2026.
Which products and versions are affected?: Rapid7 Metasploit Framework 6.5.4 and earlier.
Is there a fix for CVE-2026-87689?: Yes: fixed in 6.5.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87689 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-87689?: Check whether you run Rapid7 Metasploit Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.5.5

Technical details

The Msf::WebServices::CredentialServlet in Metasploit Framework's REST API omits the required warden.authenticate! call in the PUT and DELETE handlers for /api/v1/credentials, while all other routes correctly enforce authentication. The vulnerable handlers directly invoke lib/msf/core/db_manager/cred.rb without authorization checks, allowing unauthenticated read, modify, and delete operations on the credential store. The fix adds the missing authentication check as the first statement in both handlers.

Affected products

Rapid7 Metasploit Framework 6.5.4 and earlier

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.