Metasploit Framework CVE-2026-109682

Exploitation requires that an operator run a Metasploit module whose code path uses send_request_cgi! to contact an HTTP server the attacker controls, and that this server return a 3xx redirect pointing to a different host; in versions before 6.5.7 the redirect was followed with no destination restriction. The practical prerequisite is therefore operator-initiated interaction with an adversary-controlled (or compromised) HTTP endpoint (UI:R), plus internal services that are network-reachable from the operator's host. Limiting factors: it only affects the send_request_cgi! redirect-following behavior, only versions prior to 6.5.7, and the attacker must induce the operator to target their server rather than exploit a passively listening service. The fix gates this behind the new HttpRedirectPolicy option defaulting to 'same_host', so patched/default-configured instances are no longer exposed.

This is a medium-severity SSRF (CVSS 4.7, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) whose real-world urgency is modest. The attack vector is network and complexity is low, but UI:R is the decisive limiter: exploitation requires a Metasploit operator to actively run a module that issues an HTTP request (via send_request_cgi!) against an attacker-controlled server. No EPSS score, SSVC decision, KEV listing, or POC is present in the provided data, so there is no public exploitation signal to weigh against the CVSS. The scope-changed metric (S:C) is appropriate and meaningful here: the bug lets the attacker pivot the operator's host into internal networks, which is the real value of the flaw, but confidentiality impact is only Low and integrity/availability are None. Net assessment: a legitimate but not emergency priority - this is a defensive/offensive-tool vulnerability that inverts trust (the attacker is typically the 'target' the operator is testing), not a widely-automatable service exploit. EPSS is absent rather than low, so no probability claim can be made; treat prioritization as patch-on-next-cycle unless operators routinely point Metasploit at untrusted/adversary-controlled HTTP servers.

A penetration tester runs a Metasploit module against a host they believe is a benign target, but that host runs a malicious HTTP server. The server responds with a 3xx redirect pointing at an internal service (e.g., http://169.254.169.254/ or an internal admin panel) reachable from the operator's network; because send_request_cgi! followed cross-host redirects without restriction in versions before 6.5.7, Metasploit issues the request on the attacker's behalf. No public exploit identified at time of analysis, though the fixing PR (rapid7/metasploit-framework#21979) documents the exact code path.