CVE-2026-109682

Metasploit Framework versions before 6.5.7 allow HTTP requests made through sendrequestcgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable...