CVE-2026-109682
Metasploit Framework HTTP Redirect Server-Side Request Forgery
- State
- Published
- Severity
- 4.7 Medium
- Published
- Oct 20, 2026
- Updated
- Oct 28, 2026
- Reserved
- Oct 12, 2026
Description
Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.7 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N | rapid7 |
Weaknesses
- CWE-918 Server-Side request forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
Metasploit FrameworkRapid7 |
|
References
- https://github.com/rapid7/metasploit-framework/pull/21979patchrelease-notes
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.