CVE-2026-16895

Executive Summary

CVE-2026-16895 is an authentication bypass vulnerability affecting the Metasploit Framework's JSON-RPC web service interface. The vulnerability stems from a fail-open logic flaw in the authentication state machine that allows unauthenticated local access to the RPC dispatcher when specific environmental conditions combine. At the time of writing, no patch exists, no CISA KEV listing is present, and no public proof-of-concept has been released; however, the vulnerability is unpatched and trivially reachable under the described conditions, making affected deployments immediately exposed.

Technical Analysis

The vulnerability resides in the JSON-RPC web service interface of the Metasploit Framework. According to the NVD description, the flaw is a logic vulnerability classified under CWE-305 (Authentication Bypass by Primary Weakness) with a fail-open condition. The mechanism can be decomposed as follows:

Authentication Token Lifecycle: The JSON-RPC interface is designed to authenticate requests via an API token. When the interface is operational, an internal state flag, referenced verbatim as msf.auth_initialized, tracks whether the authentication mechanism has been properly initialized. During initialization, the framework checks for the presence of the environment variable MSF_WS_JSON_RPC_API_TOKEN. This variable is expected to contain a valid secret that authenticates incoming RPC requests.

Error Condition and State Corruption: The vulnerability is triggered when an exception occurs during the database health check, referenced verbatim as db.check. The exact nature of the exception is not specified in the available information, but it is an error-handling flaw: when the exception fires, the application's error handling path incorrectly resets the msf.auth_initialized flag to false. This reset is the root cause of the fail-open condition.

Fail-Open Interpretation: The authentication strategy, referenced verbatim as the "ApiToken Warden" strategy, evaluates the msf.auth_initialized flag to determine whether authentication is required. The intended logic is that if the flag is true, authentication is enforced. However, the strategy's logic treats a false value as an indicator that authentication has not been initialized and therefore is not required. This is the classic fail-open error: the code assumes that an uninitialized state is benign rather than a security boundary condition. Consequently, the request dispatcher processes incoming JSON-RPC requests without any credential validation.

Precondition: The vulnerability only manifests when MSF_WS_JSON_RPC_API_TOKEN is not explicitly set in the environment. If the token is set, the Warden strategy enforces authentication regardless of the state flag, limiting the exposure to deployments that rely on the default configuration or have not configured an API token.

Attack Surface: The affected interface is the JSON-RPC web service. This is an HTTP-based interface that accepts API calls. The vulnerability grants unauthenticated access to the JSON-RPC request dispatcher, meaning an attacker can invoke any method exposed through that interface without authentication.

State Machine Weakness: The core defect is that the authentication state machine conflates "error during initialization" with "authentication not required." This is a fail-open pattern observed in numerous other products where error handling paths skip security checks. The fact that a database health check exception can propagate to reset an authentication flag indicates that error isolation between components is insufficient — a health check failure should never impact the authentication state.

Exploitation Scenarios

Prerequisite Assessment: Exploitation requires two conditions to be met: (1) the target is running a Metasploit Framework instance with the JSON-RPC web service exposed, and (2) the environment variable MSF_WS_JSON_RPC_API_TOKEN is unset. No CVE-specific patch exists, so the vulnerability class remains exploitable on all deployed versions.

Reconnaissance and Target Identification: An attacker would identify exposed Metasploit JSON-RPC endpoints via network scanning, typically on the default RPC port (55553) or via HTTP banner grabbing. Service fingerprinting would confirm the presence of the Metasploit RPC interface. Since the public Shodan dorks above enumerate common listing patterns, the attacker can readily build a list of candidate targets.

Flaw Triggering: The attack chain begins with causing an exception in the database health check (db.check). The attacker does not need to directly trigger this exception themselves if the target environment naturally experiences a transient database failure (e.g., a flapping database connection, a hung query) or if the attacker can send a JSON-RPC request that forces this code path into an error state. The NVD description states that the exception occurs "during the database health check," so the trigger may be environmental rather than attacker-controlled. Insufficient technical detail is available to confirm whether an attacker can deterministically force this exception via a crafted RPC call; however, the attack surface exposure does not depend on it — any ambient exception condition primes the vulnerable state.

Authentication Bypass Execution: Once the msf.auth_initialized flag is reset to false, the ApiToken Warden strategy treats the system as having no authentication requirement. The attacker then sends JSON-RPC requests directly to the dispatcher without any token, and the dispatcher processes them as trusted. No specific payload structure is documented in the CVE description, but JSON-RPC method invocation is the natural attack primitive. The severity of this is dictated by which RPC methods are exposed and what privileges they grant — the NVD data does not enumerate the exposed methods, so a conservative assessment is that all dispatcher-accessible methods become unauthenticated.

Post-Exploitation Impact: Successful unauthenticated access to the Metasploit JSON-RPC dispatcher grants the attacker the ability to issue commands against the framework's backend. Given Metasploit's purpose as a penetration testing and exploitation framework, the RPC interface likely exposes methods for module execution, session management, and auxiliary scanning. If the RPC endpoint permits it, the attacker could achieve full remote code execution on the host, pivot into the victim network, or exfiltrate data. The NVD description does not enumerate which specific RPC methods are exposed, nor whether shell access is directly obtainable, so a conservative report is warranted; however, given that the RPC interface is a control plane for Metasploit, the practical impact is expected to be significant.

Reported Exploitation Activity: No public PoC exists, no Nuclei template is available, and FIRST.org has not assigned an EPSS score. No threat-actor campaigns have been publicly attributed to this CVE — a finding consistent with the fact that it is newly published and unpatched.

Impact Assessment

The business impact of CVE-2026-16895 is severe, though constrained by the precondition of an unset API token. Portions of the affected attack surface are expected to be limited in practice because many production Metasploit deployments set MSF_WS_JSON_RPC_API_TOKEN as a security baseline; however, misconfiguration is common and those instances are exposed.

The CVSS score is N/A, so no official severity vector exists to reference; nonetheless, the fail-open authentication bypass combined with the framework's inherent capability (running exploits, managing sessions, executing post-exploitation modules) suggests the effective risk is High to Critical. The blast radius is significant: a Metasploit instance is typically provisioned with access to internal networks, credentials, and tooling. Compromise of the RPC dispatcher would be equivalent to compromising the operator's operational control plane.

• Confidentiality: Unauthenticated access may allow reading of RPC method responses, including session data, scan results, and stored credentials.
• Integrity: An attacker can issue commands that alter framework state, run modules, and tamper with the penetration test infrastructure.
• Availability: Malicious use of RPC methods could crash the framework or exhaust resources, though no specific denial-of-service vector is documented.

The CISA KEV status is NO, meaning no observed exploitation-in-the-wild has been reported. However, given the fail-open nature and lack of patch, the vulnerability is a prime candidate for future weaponization.

Detection Guidance

The following detection content targets exploitation of the fail-open authentication bypass. Detection approaches focus on the presence of unauthenticated JSON-RPC traffic, anomalies in authentication state, and error conditions triggering the vulnerability.

Sigma Rule

title: Metasploit JSON-RPC Unauthenticated Request
id: 7f6d3a2e-9c51-4b7d-8e9f-0c2d4a6b8e10
status: experimental
description: Detects unauthenticated JSON-RPC requests to Metasploit RPC endpoints, indicating a possible CVE-2026-16895 exploitation attempt.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-16895
author: Valtersit Threat Intelligence
date: 2026/04/05
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs for Metasploit RPC endpoint'
detection:
    selection_rpc_endpoint:
        cs-uri-path|startswith:
            - '/api'
            - '/rpc'
            - '/jsonrpc'
    selection_no_auth:
        cs-username: '-'
    filter_known_healthcheck:
        cs-uri-query|contains: 'db.check'
    condition: selection_rpc_endpoint and selection_no_auth and not filter_known_healthcheck
level: high

YARA Rule

rule metasploit_auth_failopen
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects probable CVE-2026-16895 exploitation - unauthenticated JSON-RPC to Metasploit"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-16895"
        date = "2026-04-05"
    strings:
        $jsonrpc_call = /"method"\s*:\s*"[a-zA-Z0-9_\.]+"/ ascii wide
        $jsonrpc_version = /"jsonrpc"\s*:\s*"2\.0"/ ascii wide
        $no_token_field = /&(?!auth)[a-zA-Z0-9_]+=/
        $api_ns = /"api"|"rpc"|"dispatcher"/ ascii
    condition:
        filesize < 10MB and
        uint16(0) == 0x0A0D and
        any of ($jsonrpc_call*) and
        any of ($jsonrpc_version*) and
        for any of ($no_token_field*) : ( # no token present )
        and any of ($api_ns*)
}

Note: The YARA rule detects HTTP requests intended for the JSON-RPC interface that lack an authentication token. It is endpoint-focused; the expected usage is to apply it to proxy access logs or captured traffic.

Suricata IDS Rule

alert http any any -> any any (msg:"Metasploit JSON-RPC unauthenticated request - possible CVE-2026-16895"; flow:established,to_server; content:"POST"; http_method; content:"/api/"; http_uri; content:"jsonrpc"; http_uri; content:"method"; http_client_body; pcre:!/auth[^=]*=[^&;]/Ui; reference:cve,2026-16895; classtype:attempted-admin; sid:202616895; rev:1;)

Elastic Detection

// Detect unauthenticated access to Metasploit JSON-RPC endpoint
sequence by host.name, source.ip with maxspan=5m
  [network where event.type == "connection" and destination.port == 55553]
  [http where event.category == "web" and
    http.request.method == "POST" and
    http.request.uri like "*/api/*" and
    not http.request.headers.authorization:*
  ]

Splunk SPL Query

index=http sourcetype=access_combined earliest=-24h
| search "jsonrpc" OR uri_path="/api/" OR uri_path="/rpc/"
| search NOT authorization=* NOT auth_token=* NOT token=*
| lookup cve_lookup cve_id AS CVE-2026-16895 OUTPUT description
| stats count, values(uri_path), values(src_ip) by dest_ip, method, _time
| where count > 1
| table _time, src_ip, dest_ip, method, uri_path, count

Wazuh OSSEC Rule

The following Wazuh rule detects access to the Metasploit RPC without authentication tokens in the access log:

<group name="metasploit,">
    <rule id="100168" level="12">
        <decoded_as>web-access</decoded_as>
        <match>POST /api/</match>
        <regex>^(?!.*(?:token|auth).*).*</regex>
        <description>Potential Metasploit JSON-RPC unauthenticated access - possible CVE-2026-16895 exploitation</description>
        <mitre>
            <id>T1190</id>
        </mitre>
        <group>attck.execution,attck.initial_access</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Status: CVE-2026-16895 is UNPATCHED. The patch confidence is 0/4, with no patch evidence from any tracked source, no vendor fix, and no workarounds documented by the vendor. All affected customers must assume that no official remediation exists at this time.

Immediate Mitigations:

1. Set the API token: The singular most effective mitigation is to explicitly set the MSF_WS_JSON_RPC_API_TOKEN environment variable to a strong random value. This neutralizes the fail-open condition, because the ApiToken Warden strategy will enforce authentication even if the msf.auth_initialized flag is reset to false.
2. Restrict network access: Binding the JSON-RPC interface to localhost only (127.0.0.1) or placing it behind a firewall that limits source IPs to trusted management hosts drastically reduces the attack surface.
3. Disable the JSON-RPC interface: If the interface is not required for operations, disable it entirely.
4. Monitor database health: Because the vulnerability is triggered by an exception in db.check, ensuring database health and reliability reduces the odds of the vulnerable state being entered accidentally.

Patch / Upgrade Steps:

• Until Rapid7 releases a patched version, there is no upgrade path that resolves this CVE. Earmark deployment of a patched framework version as soon as one is published by the vendor.
• Monitor Rapid7 advisory channels for an update specific to this CVE.

Long-Term Hardening:

• Treat all stateful authentication flags as immutable after initialization; any reset of such flags should trigger an alert.
• Apply a "fail-closed" philosophy for security state changes — an error should never disable authentication.
• Harden the framework by removing unnecessary RPC methods, and enforce mutual TLS on the JSON-RPC interface in addition to token authentication.
• Add integrity monitoring on the authentication configuration to detect unauthorized state changes.
• Review the backend database connection configuration to minimize transient failures that can trigger the vulnerable code path.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-16895
2. Rapid7 Product Security Advisories (primary vendor): https://www.rapid7.com/security/
3. CWE-305 Authentication Bypass by Primary Weakness: https://cwe.mitre.org/data/definitions/305.html
4. Metasploit Framework GitHub (for version tracking): https://github.com/rapid7/metasploit-framework
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence has been publicly documented for CVE-2026-16895 as of the report date. The impact of this CVE is reserved for enterprise-grade deployments of the Metasploit Framework that expose their JSON-RPC interface with default security misconfigurations.