CVE-2026-109682
Metasploit Framework HTTP Redirect Server-Side Request Forgery
CVSS Score
4.7
EPSS Score
0.0%
EPSS Percentile
0th
Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker.
| CWE | CWE-918 |
| Vendor | rapid7 |
| Product | metasploit framework |
| Published | Oct 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for rapid7 metasploit framework
Be the first to know when new medium vulnerabilities affecting rapid7 metasploit framework are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
Rapid7 / Metasploit Framework
0 < 6.5.7
References
Credits
Adiel Sol, Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel, Shir Sadon DREAM Security Research Team