[ CVE-2026-109682 · Published 21 Oct 2026 ]
Vulnerability in Rapid7 Metasploit Framework
CVSS 4.7
EPSS <1%No fix listed yet
[ Description ]Official description
Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.