Medium severity · published Aug 27, 2026
CVE-2026-16895
Authentication Bypass in Metasploit JSON-RPC Service When DB Health Check Fails
5.1
CVSS
0.2%
EPSS
No
On KEV
Description
A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check (db.check) and the environment variable MSF_WS_JSON_RPC_API_TOKEN is not explicitly set, the application resets the internal state flag msf.auth_initialized to false. The ApiToken Warden authentication strategy misinterprets this false value as an indicator that authentication is not initialized or required, thereby granting unauthenticated local access to the JSON-RPC request dispatcher.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
Metasploit-framework · Rapid7
before 6.5.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-16895
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-16895
github.com
https://github.com/rapid7/metasploit-framework/pull/21768
www.rapid7.com
https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-lot-of-summer-shells-and-fit-http-profiles/
More from Metasploit-framework
9.8
CVE-2026-87689
Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints
8.8
CVE-2026-87690
Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code Execution
7.5
CVE-2019-5645
Rapid7 Metasploit HTTP Handler Denial of Service
4.7
CVE-2026-109682
Metasploit Framework HTTP Redirect Server-Side Request Forgery
4.7
CVE-2026-109681
Metasploit Framework FTP PASV Response SSRF