CVE-2026-109682

Overview

CVE-2026-109682 exposes Metasploit Framework to unintended HTTP redirects, allowing an attacker to force the framework to request arbitrary internal services. This flaw can lead to information disclosure or unauthorized access to internal resources. The issue is present in all Metasploit Framework versions prior to 6.5.7.

Description

Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker.

Impact

The vulnerability compromises confidentiality by enabling attackers to discover internal services and potentially gain access to sensitive data. Integrity is at risk if the framework can be coerced into interacting with malicious endpoints. Availability may be affected if repeated requests exhaust resources. Defenders include system administrators and security teams managing Metasploit deployments.

Remediation

Upgrade Metasploit Framework to version 6.5.7 or later, which restricts redirects to the same host. If upgrade is not immediately possible, configure the framework’s HTTP client to disallow cross-host redirects or use a proxy that enforces host restrictions. Monitor outbound HTTP traffic for unexpected redirects to internal IP ranges.

Risk context

The CVSS v3 score of 4.7 indicates medium risk; no EPSS data is available. While not critical, the flaw can facilitate lateral movement within an operator’s network, warranting prompt attention.

Affected products

• Metasploit Framework