Organisations Must Patch Metasploit 6.5.5 to Stop Unauthenticated Credential Deletion via Web Service API

Rapid7 has released Metasploit Framework version 6.5.5 to address a critical security flaw in the web service component. The vulnerability, identified as CVE-2026-87689, allows unauthenticated users to access and modify the credential store. Organizations running versions through 6.5.4 must update to prevent unauthorized data loss or manipulation of sensitive authentication records.

How it unfolded

• The National Vulnerability Database assigned CVE-2026-87689 to the flaw, rating it 9.8 Critical.
• Researchers found that specific API routes lacked authentication checks in the web service servlet.
• Rapid7 released version 6.5.5, adding mandatory authentication to the affected handlers.

Who is affected

The vulnerability impacts all published versions of the Metasploit Framework through 6.5.4. The flaw resides in the Metasploit Framework Web Service REST API, specifically within the Msf::WebServices::CredentialServlet. While most routes in this servlet require authentication via warden.authenticate!, the update and delete handlers for the /api/v1/credentials endpoint omitted this check. This omission allows any client reaching the default 0.0.0.0:8080 listener to interact with the database manager without credentials.

Our take on the response

Rapid7’s fix in version 6.5.5 restores the missing authentication call to the vulnerable handlers. By adding warden.authenticate! as the first statement in the update and delete methods, the vendor aligns these routes with the security pattern used by the rest of the API. This patch effectively closes the gap that allowed unauthenticated access to the credential store, ensuring that all mutating and read operations now require valid authentication tokens.

Who needs to act first

Teams managing penetration testing infrastructure should prioritize updating exposed Metasploit instances. Systems accessible from untrusted networks or shared team environments require immediate attention due to the risk of credential deletion. Before applying the update, administrators should verify the current version and back up configuration files. If immediate patching is not possible, restrict network access to the web service port to trusted management interfaces only. Monitor logs for unusual activity on the API endpoints while planning the rollout.

What to do and how to stay safe: Metasploit Framework

• Verify if your Metasploit Framework version is 6.5.4 or older and schedule an update to 6.5.5.
• Restrict network access to the Metasploit Web Service port to prevent unauthenticated connections.
• Monitor API logs for unauthorized attempts to modify or delete credential records.
• Ensure that backup procedures are in place before applying updates to testing environments.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific API endpoints are vulnerable to this flaw?

The update_credential (PUT) and delete_credentials (DELETE) handlers for the /api/v1/credentials endpoint are affected.

Is there a patch available for CVE-2026-87689?

Yes, Rapid7 released Metasploit Framework version 6.5.5, which includes the fix for this vulnerability.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-87689 as 9.8 Critical.