CVE-2026-87689 | Rapid7 Metasploit Framework up to 6.5.4 CredentialServlet cred.rb update_credential/delete_credentials improper authorization

October 13, 2026 Yanac

A vulnerability was found in Rapid7 Metasploit Framework up to 6.5.4 and classified as critical. Affected by this vulnerability is the function update_credential/delete_credentials of the file lib/msf/core/db_manager/cred.rb of the component CredentialServlet. Such manipulation leads to improper authorization.

This vulnerability is listed as CVE-2026-87689. The attack may be performed from remote. There is no available exploit.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More