H3-2026-1091¶
Rapid7 Metasploit Framework JSON-RPC Authentication Bypass
| Category | SECURITY_MISCONFIGURATION |
| Base Score | 10.0 |
Description¶
The Metasploit Framework JSON-RPC service determines whether to require credentials by checking an internal msf.auth_initialized flag, which is only set once a database user or a static API token has been configured. Remote attackers can reach the JSON-RPC endpoint directly when no database users exist and no MSF_WS_JSON_RPC_API_TOKEN is configured, since the absent flag is treated as a signal to permit unauthenticated access. Once connected, remote attackers can invoke any JSON-RPC method the service exposes, including module listing and execution. The condition reflects the service's default unconfigured state rather than a flaw in a specific credential check.
Impact¶
Remote attackers gain full unauthenticated control of an exposed Metasploit Framework instance. This includes listing and executing exploit modules, reading database contents, and issuing arbitrary JSON-RPC commands. An attacker can repurpose the instance itself as a platform to attack other targets. Security teams running Metasploit as a shared service face a direct pivot point into their own tooling.