CVE-2026-109681: CWE-918 Server-Side request forgery (SSRF) in Rapid7 Metasploit Framework

The vulnerability identified as CVE-2026-109681 in Rapid7 Metasploit Framework involves the FTP client trusting the PASV response's IP:port without validation. Specifically, the FTP client does not verify that the IP:port returned in the 227 Passive Mode response matches the control connection target. This flaw enables a rogue FTP server to direct the client to connect to any arbitrary IP and port, effectively allowing server-side request forgery (SSRF). The affected versions are all versions from 0 up to but not including 6.5.7.

An attacker controlling a malicious FTP server can exploit this vulnerability to cause the Metasploit Framework client to initiate TCP connections to arbitrary hosts. This could be used to bypass network restrictions or access internal systems not otherwise reachable by the attacker. The CVSS score of 4.7 (medium severity) reflects limited confidentiality impact, no integrity or availability impact, and requires user interaction.

No official patch or remediation is currently available as per the provided data. Users should monitor the vendor advisory for updates regarding fixes. Until a patch is released, avoid connecting the Metasploit Framework FTP client to untrusted or potentially malicious FTP servers to mitigate risk.