# CVE-2026-87689: Metasploit Framework authentication bypass in credential REST API

Source: https://junglewise.ai/threats/cve-2026-87689-the-metasploit-framework-web-service-rest-api-msf-ws-exposes-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-87689 · Severity: critical · CVSS 9.8 · Published 2026-10-13

Metasploit Framework's web service REST API fails to authenticate certain credential management requests, allowing anyone with network access to read, modify, or delete stored passwords, private keys, and hashes used by security teams. An attacker who can reach the default listener at 0.0.0.0:8080 can steal or sabotage credentials without providing any authentication, leading to compromise of systems targeted during penetration tests or red team exercises.

Technologies: [Rapid7 Metasploit Framework](https://junglewise.ai/threats/technologies/metasploit-framework). Vendors: [Rapid7](https://junglewise.ai/threats/vendors/rapid7).

## Quick answers

**Is CVE-2026-87689 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87689 being exploited in the wild.

**How severe is CVE-2026-87689?** Critical severity, with a CVSS score of 9.8, published 13 October 2026.

**Which products and versions are affected?** Rapid7 Metasploit Framework 6.5.4 and earlier.

**Is there a fix for CVE-2026-87689?** Yes: fixed in 6.5.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-87689 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-87689?** Check whether you run Rapid7 Metasploit Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.5.5

## Technical details

The Msf::WebServices::CredentialServlet in Metasploit Framework's REST API omits the required warden.authenticate! call in the PUT and DELETE handlers for /api/v1/credentials, while all other routes correctly enforce authentication. The vulnerable handlers directly invoke lib/msf/core/db_manager/cred.rb without authorization checks, allowing unauthenticated read, modify, and delete operations on the credential store. The fix adds the missing authentication check as the first statement in both handlers.

## Affected products

- Rapid7 Metasploit Framework 6.5.4 and earlier

## Timeline

- 2026-10-13: disclosed

## References

- [https://github.com/rapid7/metasploit-framework](https://github.com/rapid7/metasploit-framework)
- [https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5](https://github.com/rapid7/metasploit-framework/releases/tag/6.5.5)

## Related threats

- [Metasploit Framework HTTP redirect server-side request forgery](https://junglewise.ai/threats/cve-2026-109682-metasploit-framework-versions-before-6-5-7-allow-http-requests)
- [Metasploit Framework relative path traversal in iOS image gather](https://junglewise.ai/threats/cve-2026-87690-the-metasploit-framework-post-module-post-apple-ios-gather-ios)
- [Rapid7 Metasploit Framework JSON-RPC auth bypass](https://junglewise.ai/threats/cve-2026-16895-rapid7-metasploit-framework-json-rpc-auth-bypass)