CVE-2026-16895: CWE-305 Authentication bypass by primary weakness in Rapid7 Metasploit-framework
Description
CVE-2026-16895 is a logic vulnerability in the Rapid7 Metasploit Framework's JSON-RPC web service interface. It arises when an exception during the database health check causes the internal authentication state to reset improperly if a specific environment variable is not set. This leads to an authentication bypass, granting unauthenticated local access to the JSON-RPC request dispatcher.
CVSS v4.0
Score 5.1medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability is a fail-open logic flaw in the Metasploit Framework's JSON-RPC interface. Specifically, if an exception occurs during the db.check operation and the environment variable MSF_WS_JSON_RPC_API_TOKEN is not set, the internal flag msf.auth_initialized is reset to false. The ApiToken Warden authentication strategy then misinterprets this false value as meaning authentication is not required, allowing unauthenticated local users to access the JSON-RPC request dispatcher.
Potential Impact
The vulnerability allows unauthenticated local users to bypass authentication controls and access the JSON-RPC interface of the Metasploit Framework. This could potentially allow unauthorized local actions via the JSON-RPC service. No known exploits in the wild have been reported.
Mitigation Recommendations
No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, setting the environment variable MSF_WS_JSON_RPC_API_TOKEN explicitly may prevent the fail-open condition. Restricting local access to the JSON-RPC interface is also advisable.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3p6c-gvpg-f24w
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-16895"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9053f9acd9273b49696ae7
Added to database: 08/27/2026, 15:12:57 UTC
Last enriched: 09/10/2026, 07:38:41 UTC
Last updated: 10/11/2026, 18:48:17 UTC
Views: 126
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.