CVE-2026-121139 · Other
NO FIX YET · SEE WHAT TO DO
When the Metasploit msf-ws REST API has no users yet, the user-creation endpoint skips authentication and lets any caller create an administrator account. An attacker who reaches the API first gets admin access to the Metasploit instance.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Metasploit Framework with the msf-ws REST API enabled, especially on a fresh install where no users exist yet. Installations with an existing administrator account or without the REST API exposed are not exposed through this path.
Not affected if api-not-exposed, users-already-created, version-6.5.9-or-later
Who cares metasploit, msf-ws, self-hosted
msfconsole --version and compare it to the fixed version.6.5.9 or later.The Rapid7 Metasploit msf-ws suffers from a missing authentication vulnerability whereby the REST API grants an unauthenticated "bootstrap" exemption so that the very first administrator can be created when the users table is empty. While the table is empty, POST /api/v1/users is exempt from authentication by design: the route handler calls warden.authenticate!(scope: :admin_api), which resolves to AdminApiToken. The inherited ApiToken#authenticate! short-circuits and returns success!() whenever msf.auth_initialized is false, without ever evaluating AdminApiToken's administrator check. In that state the endpoint creates a user — including an administrator — for an entirely unauthenticated caller.
This issue has been fixed in version 6.5.9.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.