CVE-2026-87689

Executive Summary

CVE-2026-87689 is a critical authentication bypass (CWE-306) in the Metasploit Framework Web Service REST API (msf-ws) affecting all published versions through 6.5.4. The update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials in Msf::WebServices::CredentialServlet omit the warden.authenticate! call that every other route enforces, allowing any unauthenticated client reaching the default 0.0.0.0:8080 listener to read, modify, or permanently delete the entire credential store. With a CVSS base score of 9.8, this represents a high-severity exposure of passwords, hashes, and private keys maintained for shared team engagements.

Technical Analysis

The vulnerability resides in the Metasploit Framework Web Service (msf-ws), a REST API component that exposes framework functionality over HTTP. The affected servlet is Msf::WebServices::CredentialServlet, which governs credential store operations. Authentication in this servlet is enforced through a Warden middleware call: warden.authenticate!. Per the NVD description, every mutating and read route in the servlet invokes this call before processing a request — except the update_credential (PUT) handler and the delete_credentials (DELETE) handler for the /api/v1/credentials endpoint.

Because these two handlers omit the warden.authenticate! call, requests routed to them bypass the authentication middleware entirely. The handlers then call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own. The result is a complete absence of both authentication and authorization for these specific code paths — a textbook CWE-306 (Missing Authentication for Critical Function) condition.

The attack surface is the web service's default network listener bound to 0.0.0.0:8080. Any host with network reachability to that port can issue PUT and DELETE requests to /api/v1/credentials and have them processed as if fully authenticated. The description confirms that the exposure permits reading, modifying, and permanently deleting every stored credential record, including passwords, hashes, and private keys.

Critically, the omission is inconsistent with the rest of the servlet — every other route calls warden.authenticate! first. This indicates a development oversight rather than an intentional trust boundary. The fix in 6.5.5 simply adds warden.authenticate! as the first statement in both handlers, restoring parity with the established pattern.

No public proof-of-concept, Nuclei template, or exploit code has been released as of this report. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network reachability, low attack complexity, no privilege requirements, no user interaction, high confidentiality, integrity, and availability impact within the same security scope.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (missing authentication) and the technical details documented in the NVD description.

1. Reconnaissance / target identification. An attacker scans for hosts exposing msf-ws on its default 0.0.0.0:8080 listener. This may be internet-exposed or reachable from an adjacent network segment. Banner, header, or response fingerprinting can identify the Metasploit Framework Web Service.

2. Flaw class triggered — missing authentication. The attacker issues HTTP requests to the /api/v1/credentials endpoint. Because the update_credential (PUT) and delete_credentials (DELETE) handlers omit the warden.authenticate! call, the requests are processed without any authentication challenge or session validation. No credentials, tokens, or Warden session state are required.

3. Payload/execution at the vulnerability-class level. Using a PUT request to the credential endpoint, the attacker submits credential data that is passed into lib/msf/core/db_manager/cred.rb, which applies it without authorization checks — modifying or creating credential records. A DELETE request to the same endpoint reaches delete_credentials, which invokes the credential store deletion path without authorization, removing records. The specific request body schema is not documented in the NVD description and is not fabricated here.

4. Post-exploitation impact. The attacker can (a) read the credential store, exfiltrating passwords, hashes, and private keys collected for shared team engagements; (b) tamper with stored credentials to poison subsequent authenticated operations or pivot into downstream systems using falsified entries; and (c) permanently delete the entire credential store, destroying engagement data and disrupting operations (availability impact).

Impact Assessment

Successful exploitation yields high impact across all three CVSS confidentiality, integrity, and availability metrics (C:H/I:H/A:H) with a 9.8 base score. The credential store is a high-value target: it aggregates passwords, password hashes, and private keys gathered during penetration testing and red team engagements. Compromise is not merely a data breach — it can cascade into lateral movement against client environments whose secrets are stored in the framework.

• Confidentiality (High): Attacker reads every stored credential, including private keys usable for authentication to other systems.
• Integrity (High): Attacker modifies credential records, potentially poisoning later operations or injecting attacker-controlled secrets.
• Availability (High): Attacker permanently deletes the credential store, destroying engagement data that may be difficult or impossible to reconstruct.

The blast radius extends beyond the Metasploit host itself. Because the exposed data includes reusable secrets for other environments, one instance of msf-ws exposure can translate into compromise of multiple downstream systems. All published Metasploit Framework versions through 6.5.4 are affected. Shared team deployments — where multiple operators rely on a single credential store — are most exposed.

Detection Guidance

Sigma Rule

title: Metasploit msf-ws Credential Endpoint Access Without Authentication
id: 9f3c1a74-6b2e-4d51-9c8e-0a7d5f1e3b22
status: experimental
description: Detects unauthenticated PUT or DELETE requests to the Metasploit Web Service credential API endpoint, consistent with CVE-2026-87689 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87689
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_method:
    cs-method:
      - 'PUT'
      - 'DELETE'
  selection_uri:
    cs-uri-stem|contains: '/api/v1/credentials'
  filter_authenticated:
    cs-username|exists: true
  condition: selection_method and selection_uri and not filter_authenticated
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-username
falsepositives:
  - Legitimate authenticated API clients (will carry a username/session indicator)
level: high

YARA Rule

rule CVE_2026_87689_Metasploit_Credential_Servlet
{
    meta:
        description = "Detects Metasploit msf-ws CredentialServlet source containing credential routes (context rule for CVE-2026-87689)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87689"
        severity = "critical"

    strings:
        $servlet   = "Msf::WebServices::CredentialServlet" ascii
        $route_put = "update_credential" ascii
        $route_del = "delete_credentials" ascii
        $warden    = "warden.authenticate!" ascii
        $apipath   = "/api/v1/credentials" ascii
        $dbmg      = "db_manager/cred.rb" ascii

    condition:
        $servlet and $apipath and ($route_put or $route_del) and $dbmg
}

Suricata IDS Rule

alert http any any -> any 8080 (msg:"CVE-2026-87689 Metasploit msf-ws Unauthenticated Credential API Access"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:"/api/v1/credentials"; http.method; content:"DELETE"; http.uri; content:"/api/v1/credentials"; classtype:attempted-admin; sid:202687689; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where network.protocol == "http" and http.request.method in ("PUT","DELETE") and url.path == "/api/v1/credentials"]

Splunk SPL Query

index=web OR index=proxy
| search (cs_method=PUT OR cs_method=DELETE OR http_method=PUT OR http_method="DELETE")
| search (uri_path="/api/v1/credentials" OR url="/api/v1/credentials" OR uri="*api/v1/credentials*")
| stats count min(_time) as first_seen max(_time) as last_seen values(cs_method) as methods by src_ip, uri_path
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,metasploit,cve-2026-87689,">
  <rule id="2026877" level="12">
    <if_sid>31100</if_sid>
    <field name="method">PUT|DELETE</field>
    <url>/api/v1/credentials</url>
    <description>CVE-2026-87689: Unauthenticated PUT/DELETE against Metasploit msf-ws credential API</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). NVD states the issue is fixed in 6.5.5, but no patch has been confirmed by any tracked source at this time.

1) Immediate mitigations

• Immediately restrict network access to the msf-ws listener. The service binds to 0.0.0.0:8080 by default; firewall or bind it to 127.0.0.1 so only local clients can reach it.
• Place msf-ws behind an authenticating reverse proxy or VPN; never expose port 8080 directly to untrusted networks or the internet.
• If exposure cannot be ruled out, rotate every credential stored in the database, treat all stored passwords, hashes, and private keys as compromised, and treat any downstream system reachable with those secrets as potentially breached.
• Scan for any internet- or adjacent-network-reachable instance of the service on port 8080.

2) Patch / upgrade steps

• Upgrade Metasploit Framework to 6.5.5 or later once the vendor release is verified. The fix adds warden.authenticate! as the first statement in the affected update_credential (PUT) and delete_credentials (DELETE) handlers.
• Verify post-upgrade that all credential routes now enforce authentication by testing unauthenticated PUT/DELETE requests against /api/v1/credentials.

3) Long-term hardening

• Enforce a defense-in-depth posture so a single omitted middleware call cannot expose critical functions — e.g., authorization checks inside lib/msf/core/db_manager/cred.rb itself, not solely at the routing layer.
• Adopt automated testing that asserts every route in a servlet passes through the authentication middleware.
• Retain audit logging on all credential store mutations; alert on any unauthenticated or anomalous access.
• Apply least-privilege network segmentation for shared red-team tooling.

References

• NVD — CVE-2026-87689: https://nvd.nist.gov/vuln/detail/CVE-2026-87689
• MITRE CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
• Metasploit Framework project (Rapid7) release notes and repository for version 6.5.5.
• CISA Known Exploited Vulnerabilities catalog — not listed at time of writing.
• No public proof-of-concept, Nuclei template, or exploit code was available at time of writing; no coordinated threat actor campaign has been attributed to this CVE in the provided data.