Rapid7 Metasploit-framework vulnerabilities

Latest Rapid7 Metasploit-framework CVEs

Newest publication first

1. CVE-2026-16895 Authentication Bypass in Metasploit JSON-RPC Service When DB Health Check Fails

   Published 2026-08-27

   Medium·CVSS 5.1 EPSS 0.23%

   A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check (db.check) and the environment variable MSF_WS_JSON_RPC_API_TOKEN is not explicitly set, the...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.