CVE-2026-16895

Name of the Vulnerable Software and Affected Versions Metasploit Framework versions prior to 6.5.2

Description A logic flaw exists in the JSON-RPC web service interface that can lead to a fail-open condition. If an exception occurs during the db.check() function and the MSF WS JSON RPC API TOKEN environment variable is not explicitly set, the application resets the msf.auth initialized internal state flag to false. The ApiToken Warden authentication strategy misinterprets this value as an indication that authentication is not required or initialized, granting unauthenticated local access to the JSON-RPC request dispatcher.

Recommendations Update to Metasploit Framework version 6.5.2 or later. Verify the API-token configuration. Restrict access to RPC interfaces. Monitor for unexpected local JSON-RPC activity.