Metasploit Framework CVE-2026-16895

Exploitation requires all three of the following conditions simultaneously: (1) the Metasploit JSON-RPC web service (msf-json-rpc.ru) must be actively running; (2) the MSF_WS_JSON_RPC_API_TOKEN environment variable must NOT be set in the service process environment - this is the case when operators rely solely on database-backed authentication without a static token; and (3) the db.check database health-check method must raise an exception at runtime, which occurs when the Metasploit PostgreSQL backend is unreachable, crashes, or is misconfigured after service startup. Exploitation is strictly limited to local attack surface (AV:L per the CVSS 4.0 vector) - the attacker must reach port 8081 from the same host or local network segment. No prior authentication or privileges are required once conditions are met (PR:N). This vulnerability does NOT affect deployments where MSF_WS_JSON_RPC_API_TOKEN is explicitly set, as that env-var path bypasses the fail-open logic entirely.

The CVSS 4.0 base score of 5.1 (AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) reflects a local attack surface with limited confidentiality and integrity impact on the vulnerable system plus low subsequent-system exposure. No EPSS data was provided and this CVE is absent from the CISA KEV catalog, suggesting no confirmed widespread exploitation. The real-world risk is higher than the score implies for security teams running Metasploit in multi-user or automated environments - shared pentest infrastructure, CI/CD pipelines, or headless lab setups where the JSON-RPC service is active and the env var is not explicitly configured are plausible targets. Because the fail-open triggers on a db exception (which can occur naturally due to PostgreSQL downtime or misconfiguration), the attack is not fully attacker-controlled, which justifies the vendor's AC:L assertion only partially - an attacker who can influence database reachability could force the condition. No conflicting data between sources was identified, but the absence of EPSS and version-specific CPE data limits confidence in quantifying exploitation probability.

An attacker with local access to a shared pentest server or CI/CD host running Metasploit's JSON-RPC service - where MSF_WS_JSON_RPC_API_TOKEN was never set - waits for or causes the PostgreSQL database to become unreachable, triggering the db.check exception and resetting auth_initialized. The attacker then sends unauthenticated JSON-RPC HTTP requests to port 8081 to enumerate active sessions, retrieve credentials from the loot database, or execute Metasploit modules against targets already in the operator's scope. No public POC has been identified, but the two-condition trigger is straightforward to reproduce from the description.