CVE-2026-109682 is a server-side request forgery (SSRF) vulnerability in Rapid7 Metasploit Framework versions before 6.5.7. The flaw allows HTTP requests made through the send_request_cgi! method to follow redirects to different hosts without restrictions. This can enable a malicious HTTP server to induce the Metasploit operator's system to make arbitrary HTTP requests to internal or otherwise inaccessible services.
CVE-2026-109681 is a server-side request forgery (SSRF) vulnerability in the FTP client component of Rapid7 Metasploit Framework. The vulnerability arises because the FTP client trusts the IP and port specified in the server's PASV response without validating it against the control connection target. This allows a malicious FTP server to specify an arbitrary IP and port, causing the operator's machine to open a TCP connection to an unintended host.
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls warden.authenticate! before processing a request, except the update_credential (PUT) and delete_credentials (DELETE) handlers for /api/v1/credentials, which omit the authentication call entirely. Because these handlers call directly into lib/msf/core/db_manager/cred.rb, which performs no authorization check of its own, any client able to reach the web service on its default 0.0.0.0:8080 listener can read, modify, or permanently delete every stored credential record — including passwords, hashes, and private keys stored for a shared team engagement — without presenting any authentication. All published versions of Metasploit Framework through 6.5.4 are affected. The issue is fixed in 6.5.5 by adding warden.authenticate! as the first statement in both handlers, matching the pattern used by every other route in the API.
CVE-2026-87690 is a path traversal vulnerability in the Metasploit Framework's post module post/apple_ios/gather/ios_image_gather. It allows an attacker controlling a hostile iOS device to write arbitrary files on the pentester's workstation by manipulating file names in a directory listing. This can lead to persistent code execution as the operator, potentially with root privileges, when msfconsole is next launched. The issue arises from lack of sanitization of file names before writing to the local filesystem. A fix involves sanitizing file names to prevent directory traversal.
CVE-2026-78413 is a medium severity vulnerability in Rapid7 Velociraptor versions before 0.77.3. It involves incorrect default permissions in the Windows.Sysinternals.SysmonLogForward artifact, which allows users with COLLECT_CLIENT permissions (typically the Investigator role) to specify an arbitrary binary path and execute a different binary than intended. This could lead to limited confidentiality, integrity, and availability impacts. Exploitation requires existing artifact collection permissions on the endpoint.
CVE-2026-78411 is a vulnerability in Rapid7 Velociraptor where the SetClientMetadata function uses an incorrect permission check. This flaw allows users with LABEL_CLIENTS permission to update server metadata, which is typically reserved for server administrators. Server metadata often contains site-wide configuration data, so unauthorized modification could impact system integrity. The vulnerability affects Velociraptor versions from initial releases up to but not including 0.77.3. The CVSS score is 6.5, indicating a medium severity level.
CVE-2026-78412 is an authorization bypass vulnerability in Rapid7 Velociraptor's WatchEvent gRPC API. The API allows specifying the OrgId to stream events from, but the server incorrectly checks permissions against the caller's organization rather than the requested one. This flaw enables a user with API access in one organization to read events from another organization without authorization. The vulnerability affects Velociraptor versions prior to 0.77.3. The CVSS score is 4.9, indicating medium severity.
Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/export_manager.py`), whereby the `export_id` value — an unvalidated MCP tool argument reaching the function via the `check_rapid7_export_status` and `download_rapid7_export` tools — is interpolated directly into the GraphQL query string. A crafted `export_id` containing quote and brace characters can terminate the intended `export(id: "...")` selection early and append attacker-controlled root-level selections (for example, schema introspection), producing a single well-formed GraphQL document that is then sent to the Rapid7 export API under the operator's own API key.
Notably, this issue does not grant an existing actor any access they do not already have: every injected query executes within the operator's own already-authenticated API scope, using the operator's own valid API key, and cannot cross a tenant or account boundary. A directly-malicious operator gains nothing they could not already do by calling the API directly; the realistic exposure is limited to a compromised or careless upstream MCP client, or indirect prompt injection forwarding an unvalidated identifier. This is fixed in version 0.6.2, which passes `export_id` as a parameterized GraphQL variable (`$exportId: ID!`).
CVE-2026-89325 is a high-severity vulnerability in Rapid7 Insight Agent on Windows involving an uncontrolled search path element. A local, low-privileged user can execute arbitrary code as SYSTEM by placing a malicious executable named 'code' in a writable directory that appears earlier in the machine PATH than the legitimate Visual Studio Code. This affects all Insight Agent versions running assessment content at or below version 0.0.261.0. The issue was fixed in assessment content version 0.0.269.0, which was automatically deployed, requiring no customer action.
Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.
Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiled_collector_args" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who can schedule a hunt (minimal role of "investigator" ) to set the compiled VQL statements for the hunt bypassing any ACL checks that would normally be applied.
This flaw can then be escalated to allow the "investigator" user to run arbitrary VQL statements as an administrator user on the Velociraptor server.
CVE-2026-19584 is a vulnerability in Rapid7 Velociraptor affecting versions from 0 up to but not including 0.77.2. It involves improper neutralization of special elements in a template engine used during notebook backup restoration. A user with NOTEBOOK_EDITOR permission can inject a VQL query into notebook cell content, which is then evaluated with elevated permissions upon backup restoration.
CVE-2026-19583 is a critical vulnerability in Rapid7 Velociraptor versions before 0.77.2 involving incorrect permission assignment for sensitive artifacts. Specifically, client monitoring artifacts lacked proper permission checks, allowing users with scheduling rights for these artifacts to also schedule highly privileged artifacts like Linux.Sys.BashShell, which enables arbitrary command execution on endpoints. This flaw could lead to unauthorized privilege escalation and control over affected systems.
CVE-2026-16895 is a logic vulnerability in the Rapid7 Metasploit Framework's JSON-RPC web service interface. The flaw arises when an exception during a database health check causes the internal authentication state to reset improperly, allowing unauthenticated local access. This occurs if the environment variable MSF_WS_JSON_RPC_API_TOKEN is not set, leading the authentication mechanism to mistakenly allow access without credentials. The vulnerability affects versions prior to 6.5.2 and has a medium severity rating.
CVE-2026-19200 is a high-severity vulnerability in Rapid7 Velociraptor versions prior to 0.77.2. It involves a missing authorization check in the verify() VQL function, which allows users with NOTEBOOK_EDIT permission to overwrite existing artifacts in the global artifact repository without proper permissions. This flaw could lead to significant confidentiality, integrity, and availability impacts.
CVE-2026-15371 is a high-severity vulnerability in Rapid7 Velociraptor versions from 0 up to but not including 0.77.2. The web GUI allows users to specify a custom column type as a URL, but it does not restrict URL schemes. This flaw permits an attacker to use a JavaScript scheme, leading to a cross-site scripting (XSS) risk when users click the crafted URL in the GUI.
Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes.
In particular, a user with read access to the root org can access result sets from child orgs.
A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process.
The problem is a Divide by Zero bug in the ShouldPadFile() function.