Live › vulnerability › CVE-2026-109682
Go to dashboardMetasploit Framework before 6.5.7 follows HTTP redirects made through send_request_cgi! to any host, without limiting the destination. A malicious HTTP server can make the machine running Metasploit request internal services on the operator's network that the attacker cannot reach directly.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone who runs Metasploit Framework older than 6.5.7 and points its HTTP modules at servers they do not fully control. The risk is highest on operator workstations or testing hosts that sit on networks with internal HTTP services. Teams that only run Metasploit on fully isolated lab networks against known targets are less exposed.
No product ranges from the sources yet.
msfconsole -v or check the installed Metasploit version and see whether it is below 6.5.7.msfupdate --help or your package manager to confirm the version.6.5.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker.
This page as .md · .json · in your agent: get_signal("CVE-2026-109682")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.