CVE-2026-109682
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
59/100
Published: 2026-10-20
Modified: 2026-10-28
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Required
S:
Changed
C:
Low
I:
None
A:
None
Description
Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| Rapid7 | Metasploit Framework | 0 < 6.5.7 |
| Rapid7 | Metasploit Framework | 0 < 6.5.7 |