Rapid7 · Metasploit Framework · CVE-2026-16895
**Name of the Vulnerable Software and Affected Versions**
Metasploit Framework versions prior to 6.5.2
**Description**
A logic flaw exists in the JSON-RPC web service interface that can lead to a fail-open condition. If an exception occurs during the `db.check()` function and the `MSF WS JSON RPC API TOKEN` environment variable is not explicitly set, the application resets the `msf.auth initialized` internal state flag to false. The ApiToken Warden authentication strategy misinterprets this value as an indication that authentication is not required or initialized, granting unauthenticated local access to the JSON-RPC request dispatcher.
**Recommendations**
Update to Metasploit Framework version 6.5.2 or later.
Verify the API-token configuration.
Restrict access to RPC interfaces.
Monitor for unexpected local JSON-RPC activity.