---
id: "CVE-2026-109682"
kind: "vulnerability"
aliases: ["CVE-2026-109682"]
title: "Metasploit Framework: HTTP redirects can reach internal hosts through the operator's machine"
severity: "medium"
cvss: 4.7
epss: 0.00166
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["internal-network", "metasploit", "package", "pentest", "security-tooling"]
not_affected_if: ["no-internal-network-access", "version-6.5.7-or-later"]
published_at: "2026-10-21T00:17:18+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T04:34:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109682", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-109682", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Metasploit Framework: HTTP redirects can reach internal hosts through the operator's machine

Metasploit Framework before 6.5.7 follows HTTP redirects made through send_request_cgi! to any host, without limiting the destination. A malicious HTTP server can make the machine running Metasploit request internal services on the operator's network that the attacker cannot reach directly.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `msfconsole -v` or check the installed Metasploit version and see whether it is below `6.5.7`.
- Check the Metasploit install with `msfupdate --help` or your package manager to confirm the version.

## Fix

- Upgrade Metasploit Framework to `6.5.7` or later.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109682
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-109682

## From the sources

Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_