{"schemaVersion":3,"id":"CVE-2026-109682","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker.","dates":{"published":"2026-10-20T23:12:55.091Z","modified":"2026-10-20T23:12:55.091Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.7,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.7,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":4.7,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00166,"percentile":0.05484,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-21T00:00:00.000Z","score":0.00166,"percentile":0.05484}],"last30":[{"date":"2026-10-21T00:00:00.000Z","score":0.00166,"percentile":0.05484}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-918","name":"Server-Side Request Forgery (SSRF)","description":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/918.html"}],"affected":[{"vendor":"rapid7","product":"metasploit framework","name":"Metasploit Framework","label":"metasploit framework","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 6.5.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.5.7","eol":null,"hubHref":"/vendor/rapid7/metasploit_framework"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/rapid7/metasploit-framework/pull/21979","label":"github.com/rapid7/metasploit-framework/pull/21979","hostname":"github.com","tags":["Patch","Release Notes"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-20T23:12:55.091Z","label":"Published","detail":"Vulnerability first disclosed.","source":null}],"risk":{"score":19,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T11:34:58.259Z","stale":false,"partial":false}}