CVE-2026-87689

Name of the Vulnerable Software and Affected Versions Metasploit Framework versions prior to 6.5.5

Description The Metasploit Framework Web Service REST API (msf-ws) contains a flaw where the Msf::WebServices::CredentialServlet fails to enforce authentication for specific routes. Specifically, the update credential (PUT) and delete credentials (DELETE) handlers for the '/api/v1/credentials' endpoint omit the required authentication call. Since the underlying lib/ms/core/db manager/cred.rb does not perform its own authorization checks, any client with network access to the default 0.0.0.0:8080 listener can read, modify, or permanently delete all stored credential records, including passwords, hashes, and private keys.

Recommendations Update Metasploit Framework to version 6.5.5.