{"id":"CVE-2026-109682","kind":"vulnerability","aliases":["CVE-2026-109682"],"related":[],"title":"Metasploit Framework: HTTP redirects can reach internal hosts through the operator's machine","description":"Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker.","summary":"Metasploit Framework before 6.5.7 follows HTTP redirects made through send_request_cgi! to any host, without limiting the destination. A malicious HTTP server can make the machine running Metasploit request internal services on the operator's network that the attacker cannot reach directly.","severity":"medium","cvss":4.7,"epss":0.00166,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["internal-network","metasploit","package","pentest","security-tooling"],"not_affected_if":["no-internal-network-access","version-6.5.7-or-later"],"how_to_check":"- Run `msfconsole -v` or check the installed Metasploit version and see whether it is below `6.5.7`.\n- Check the Metasploit install with `msfupdate --help` or your package manager to confirm the version.","fix":"- Upgrade Metasploit Framework to `6.5.7` or later.","status":"open","published_at":"2026-10-21T00:17:18+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:34:57+00:00","updated_at":"2026-10-25T04:34:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:34:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Metasploit Framework to `6.5.7` or later.","reach":"network","title":"Metasploit Framework: HTTP redirects can reach internal hosts through the operator's machine","impact":"medium","summary":"Metasploit Framework before 6.5.7 follows HTTP redirects made through send_request_cgi! to any host, without limiting the destination. A malicious HTTP server can make the machine running Metasploit request internal services on the operator's network that the attacker cannot reach directly.","category":"package","nicknames":[],"who_cares":["metasploit","pentest","security-tooling","internal-network"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reaches internal HTTP services through the Metasploit host.","analyst_note":"","how_to_check":"- Run `msfconsole -v` or check the installed Metasploit version and see whether it is below `6.5.7`.\n- Check the Metasploit install with `msfupdate --help` or your package manager to confirm the version.","needs_analyst":false,"not_affected_if":["version-6.5.7-or-later","no-internal-network-access"],"who_is_affected":"Anyone who runs Metasploit Framework older than 6.5.7 and points its HTTP modules at servers they do not fully control. The risk is highest on operator workstations or testing hosts that sit on networks with internal HTTP services. Teams that only run Metasploit on fully isolated lab networks against known targets are less exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000611,"input_tokens":3386,"output_tokens":544,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109682':16A,19A '-2026':15A,18A '6.5.7':32B,76C 'access':127C 'allow':77C 'arbitrari':111C 'attack':68B,130C 'cannot':69B 'caus':102C 'cgi':40B,84C 'cve':14A,17A 'destin':47B,96C 'differ':90C 'direct':71B 'follow':33B,86C 'framework':2A,30B,73C 'host':8A,43B,91C 'http':3A,34B,50B,78C,99C,112C 'includ':120C 'intern':7A,21B,59B,121C 'internal-network':20B 'limit':45B 'machin':13A,55B 'made':36B,80C 'make':53B,108C 'malici':49B,98C 'metasploit':1A,23B,29B,57B,72C,106C 'network':22B,65B,119C 'oper':11A,63B,117C 'otherwis':126C 'packag':24B 'pentest':25B 'reach':6A,70B 'reachabl':114C 'redirect':4A,35B,87C,95C 'request':39B,58B,79C,83C,109C 'restrict':93C 'run':56B,105C 'secur':27B 'security-tool':26B 'send':38B,82C 'server':51B,100C 'servic':60B,113C,122C 'system':104C 'tool':28B 'version':74C 'without':44B,92C","nicknames":[],"mitigations":[],"who_affected":"Anyone who runs Metasploit Framework older than 6.5.7 and points its HTTP modules at servers they do not fully control. The risk is highest on operator workstations or testing hosts that sit on networks with internal HTTP services. Teams that only run Metasploit on fully isolated lab networks against known targets are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T00:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","cvss_by":"cve@rapid7.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109682","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109682","severity":null,"published_at":"2026-10-21T00:17:18+00:00","modified_at":"2026-10-22T15:25:35+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-109682","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109682","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}