What’s Vulnerable › Vulnerabilities
CVE-2026-109682: Metasploit Framework HTTP Redirect Server-Side Request Forgery
- Severity: medium (CVSS 4.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-20 · updated 2026-10-28
- Weakness: CWE-918
Description
Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker.
Affected products
- Rapid7 Metasploit Framework: before 6.5.7 — fixed in 6.5.7
How to fix
Upgrade to a fixed version: Rapid7 Metasploit Framework 6.5.7. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-109682 or the next vulnerability affects your stack