CVE-2026-121139

The Rapid7 Metasploit msf-ws suffers from a missing authentication vulnerability whereby the REST API grants an unauthenticated "bootstrap" exemption so that the very first administrator can be created when the users table is empty. While the table is empty, POST /api/v1/users is exempt from...

CVE-2026-121139

The Rapid7 Metasploit Framework Web Service (msf-ws) contains a missing authentication vulnerability (CWE-306) during a specific "bootstrap" window. When the users table is empty, the POST /api/v1/users REST API endpoint is designed to exempt the first administrator creation from authentication. ...

EUVD-2026-117544

The Rapid7 Metasploit msf-ws suffers from a missing authentication vulnerability whereby the REST API grants an unauthenticated "bootstrap" exemption so that the very first administrator can be created when the users table is empty. While the table is empty, POST /api/v1/users is exempt from...

CVE-2026-121139 Rapid7 Metasploit Framework Web Service unauthenticated bootstrap window allows creation of an administrator account without authentication

The Rapid7 Metasploit msf-ws suffers from a missing authentication vulnerability whereby the REST API grants an unauthenticated "bootstrap" exemption so that the very first administrator can be created when the users table is empty. While the table is empty, POST /api/v1/users is exempt from...

FreeBSD : metasploit -- multiple vulnerabilities (4488c0db-d45b-11f1-bae2-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 4488c0db-d45b-11f1-bae2-3497f65b111b advisory. Rapid7 published security advisories for issues fixed in releases 6.5.2 through 6.5.7. The...

CVE-2026-87689 Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints

The Metasploit Framework Web Service REST API msf-ws exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the updatecredential PUT and deletecredentials DELETE handler...

EUVD-2026-98205

The Metasploit Framework Web Service REST API msf-ws exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the updatecredential PUT and deletecredentials DELETE handler...

CVE-2026-87689: Missing Authentication for Critical Function

The Metasploit Framework Web Service REST API msf-ws exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the updatecredential PUT and deletecredentials DELETE handler...

PT-2026-111132

Name of the Vulnerable Software and Affected Versions Metasploit Framework versions prior to 6.5.5 Description The Metasploit Framework Web Service REST API msf-ws contains a flaw where the Msf::WebServices::CredentialServlet fails to enforce authentication for specific routes. Specifically, the...

metasploit -- multiple vulnerabilities

Rapid7 published security advisories for issues fixed in releases 6.5.2 through 6.5.7. The credential endpoint of the msf-ws REST API is reachable without authentication, authentication in the JSON-RPC service is skipped when the database health check fails, a post module writes files outside the...