CVE-2026-87689: CWE-306 Missing Authentication for Critical Function in Rapid7 Metasploit Framework

The Metasploit Framework Web Service REST API (msf-ws) exposes a critical authentication bypass vulnerability (CWE-306) in its credential management endpoints. Specifically, the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials omit the mandatory warden.authenticate! call, allowing any client able to access the service on its default listener (0.0.0.0:8080) to manipulate stored credentials without authentication. These credentials include sensitive data such as passwords, hashes, and private keys used in team engagements. The underlying database manager does not perform authorization checks, compounding the risk. The vulnerability is present in all published versions through 6.5.4 and is resolved in 6.5.5 by adding the missing authentication calls.

An unauthenticated attacker with network access to the Metasploit Framework Web Service can fully compromise the credential store, including reading, modifying, or deleting all stored credentials. This leads to complete confidentiality, integrity, and availability loss of credential data, which can severely impact penetration testing operations and expose sensitive secrets such as passwords and private keys.

Upgrade to Metasploit Framework version 6.5.5 or later, where the missing authentication calls have been added to the affected API handlers. Until upgrading, restrict network access to the msf-ws service to trusted users only, as the vulnerability allows unauthenticated access to critical credential management functions.