CVE-2026-16895: Metasploit Framework Auth Bypass Vulnerability

CVE-2026-16895 Overview

CVE-2026-16895 is a logic flaw in the Metasploit Framework's JSON-RPC web service that produces a fail-open authentication condition. When the database health check (db.check) raises an exception and the MSF_WS_JSON_RPC_API_TOKEN environment variable is not set, the framework resets the internal msf.auth_initialized state flag to false. The ApiToken Warden authentication strategy interprets that value as "authentication not initialized," and passes requests through without validation. A local attacker can then reach the JSON-RPC request dispatcher without credentials. The issue is tracked under CWE-305: Authentication Bypass by Primary Weakness.

Critical Impact
Unauthenticated local access to the Metasploit JSON-RPC dispatcher, exposing framework functionality to any local user when the database health check fails and no API token is configured.

Affected Products

Rapid7 Metasploit Framework — JSON-RPC web service interface
Deployments where MSF_WS_JSON_RPC_API_TOKEN is not explicitly set
Environments where the db.check operation can raise an exception at startup or runtime

Discovery Timeline

2026-08-27 - CVE-2026-16895 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-16895

Vulnerability Analysis

The Metasploit Framework exposes a JSON-RPC web service that Warden protects with the ApiToken authentication strategy. Warden decides whether to challenge a request by inspecting the msf.auth_initialized state flag. The framework sets this flag during startup based on whether an API token exists or is configured through MSF_WS_JSON_RPC_API_TOKEN.

During the database health check (db.check), an unhandled exception forces the framework into an error path that resets msf.auth_initialized to false. The ApiToken strategy treats false as an instruction to skip authentication rather than to deny the request. Any subsequent JSON-RPC call reaches the dispatcher without token validation.

Because the attack vector is local, exploitation requires access to the loopback interface or another local network path exposed by the service. See the Metasploit pull request 21768 and the Rapid7 Metasploit Wrap-Up for maintainer context.

Root Cause

The root cause is a conflation of two distinct states: "authentication not yet initialized" and "authentication check failed." Both conditions resolve to msf.auth_initialized = false, and Warden's ApiToken strategy resolves that single value in favor of allowing the request. The exception handler for db.check therefore silently disables authentication instead of failing closed.

Attack Vector

An attacker with local access to the host running the Metasploit JSON-RPC service triggers or waits for a db.check exception, for example by inducing a database connectivity failure. When MSF_WS_JSON_RPC_API_TOKEN is unset, the state flag resets and the JSON-RPC endpoint accepts unauthenticated requests. The attacker then issues JSON-RPC calls to the dispatcher to interact with framework functionality that would normally require a valid API token.

No verified exploitation code is published. The mechanism is described in prose per the linked pull request.

Detection Methods for CVE-2026-16895

Indicators of Compromise

JSON-RPC requests to the Metasploit web service originating from local users or processes that do not present a valid API token.
Log entries showing db.check exceptions immediately followed by successful JSON-RPC dispatcher calls.
Runtime transitions of msf.auth_initialized from true to false outside of a clean service restart.

Detection Strategies

Correlate Metasploit service logs for exception traces in the database health check path with subsequent JSON-RPC activity from the same process.
Inspect process command lines and environment for Metasploit services launched without MSF_WS_JSON_RPC_API_TOKEN defined.
Alert on unexpected local network connections to the JSON-RPC listener from accounts that are not authorized Metasploit operators.

Monitoring Recommendations

Enable verbose logging on the Metasploit JSON-RPC web service and forward logs to a central analytics pipeline for retention and correlation.
Monitor database availability for the backing PostgreSQL instance, since db.check failures are the precondition for the fail-open state.
Track local user activity on hosts that run Metasploit to identify unauthorized interaction with the service.

How to Mitigate CVE-2026-16895

Immediate Actions Required

Update the Metasploit Framework to a version that includes the fix merged through pull request 21768.
Set the MSF_WS_JSON_RPC_API_TOKEN environment variable explicitly on every host running the JSON-RPC service.
Restrict local access to the JSON-RPC listener to a dedicated operator account and audit membership regularly.

Patch Information

Rapid7 addressed the fail-open logic in the Metasploit Framework repository. Review the maintainer notes in the Rapid7 Metasploit Wrap-Up and the merged code in pull request 21768. Rebuild container images and redeploy any automation that pins to a pre-patch commit.

Workarounds

Bind the JSON-RPC listener to a loopback interface and place host-based firewall rules in front of it.
Run the Metasploit service under a dedicated, non-interactive user account with restrictive filesystem permissions.
Ensure the backing database is stable and reachable so that db.check does not raise exceptions in production.
Rotate any API tokens that may have been active during a period of database instability.

bash

# Configuration example: set the API token before starting the service
export MSF_WS_JSON_RPC_API_TOKEN="$(openssl rand -hex 32)"

# Bind JSON-RPC to loopback only and start the service
./msfrpcd -a 127.0.0.1 -S -f