CVE-2026-16895: CWE-305 Authentication bypass by primary weakness in Rapid7 Metasploit-framework
Description
CVE-2026-16895 is a logic vulnerability in the Rapid7 Metasploit Framework's JSON-RPC web service interface. The flaw arises when an exception during a database health check causes the internal authentication state to reset improperly, allowing unauthenticated local access. This occurs if the environment variable MSF_WS_JSON_RPC_API_TOKEN is not set, leading the authentication mechanism to mistakenly allow access without credentials. The vulnerability affects versions prior to 6.5.2 and has a medium severity rating.
CVSS v4.0
Score 5.1medium
Affected software
Rapid7
Metasploit-framework
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A fail-open logic vulnerability exists in the Metasploit Framework's JSON-RPC interface. Specifically, if an exception occurs during the db.check operation and the MSF_WS_JSON_RPC_API_TOKEN environment variable is unset, the internal flag msf.auth_initialized is reset to false. The ApiToken Warden authentication strategy interprets this as authentication not being required, granting unauthenticated local access to the JSON-RPC request dispatcher. This allows bypassing authentication controls under these conditions.
Potential Impact
An attacker with local access can bypass authentication to the JSON-RPC interface of the Metasploit Framework, potentially allowing unauthorized commands or actions via this interface. The impact is limited to local attackers and depends on the environment variable not being set. The CVSS 4.0 score is 5.1 (medium severity), reflecting the local attack vector and limited scope.
Mitigation Recommendations
No official fix or patch is currently documented. Users should ensure the environment variable MSF_WS_JSON_RPC_API_TOKEN is explicitly set to prevent the fail-open condition. Monitor vendor advisories for updates or patches addressing this issue. Until a fix is available, restricting local access to the JSON-RPC interface can reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- rapid7
- Date Reserved
- 2026-07-24T05:29:02.405Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8fb819acd9273b49c29f48
Added to database: 08/27/2026, 04:07:53 UTC
Last enriched: 09/10/2026, 09:37:54 UTC
Last updated: 10/10/2026, 06:48:15 UTC
Views: 106
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.