TI-2026-14065 Aliases CVE-2026-16895 GHSA-3p6c-gvpg-f24w

Authentication Bypass in Metasploit JSON-RPC Service When DB Health Check Fails

LOW 23CWE-305Published 2026-08-27 · Updated 2026-08-27

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check (db.check) and the environment variable MSF_WS_JSON_RPC_API_TOKEN is not explicitly set, the application resets the internal state flag msf.auth_initialized to false. The ApiToken Warden authentication strategy misinterprets this false value as an indicator that authentication is not initialized or required, thereby granting unauthenticated local access to the JSON-RPC request dispatcher.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00234 14th percentileScored 2026-11-07

Fix Fixed Metasploit-framework (Rapid7): 6.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Rapid7	Metasploit-framework	before 6.5.2	6.5.2	Patch available	CNA

Metasploit-framework VendorRapid7 Affected before 6.5.2 Fixed in 6.5.2 Patch available CNA

Remediation

Fix · CNA Metasploit-framework (Rapid7) Fixed in 6.5.2

Timeline

2026-10-02 Threatist record created from CVE-2026-16895
2026-10-03 Alias added: GHSA-3p6c-gvpg-f24w

References

Patch 1

https://github.com/rapid7/metasploit-framework/pull/21768

Advisory 1

https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-lot-of-summer-shells-and-fit-http-profiles/

TI-2023-01233 Rapid7 InsightCloudSec resource.db() method access CVSS 3.1HIGH 8.8
TI-2023-01231 Rapid7 InsightCloudSec getattr() method access CVSS 3.1HIGH 8.8
TI-2023-01232 Rapid7 InsightCloudSec box object access CVSS 3.1HIGH 8.1
TI-2024-00358 Rapid7 Minerva Armor Privilege Escalation CVSS 3.1HIGH 7.8
TI-2024-02985 Rapid7 Insight Agent Sensitive Key Exposed To Local Users CVSS 3.1MEDIUM 6.8
TI-2019-04008 Rapid7 Metasploit HTTP Handler Denial of Service CVSS 3.1HIGH 7.5

See all 139 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences