Rapid7 Metasploit Framework Web Service unauthenticated bootstrap window allows creation of an administrator account without authentication
Affects Rapid7 Metasploit Framework versions before 6.5.9 while the Web Service users table is empty. CVSS scores it 7.3 (high). Fixed in 6.5.9.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 6.5.9
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. The users table is empty (no users exist yet).
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 13/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
The Rapid7 Metasploit msf-ws suffers from a missing authentication vulnerability whereby the REST API grants an unauthenticated "bootstrap" exemption so that the very first administrator can be created when the users table is empty. While the table is empty, POST /api/v1/users is exempt from authentication by design: the route handler calls warden.authenticate!(scope: :admin_api), which resolves to AdminApiToken. The inherited ApiToken#authenticate! short-circuits and returns success!() whenever msf.auth_initialized is false, without ever evaluating AdminApiToken's administrator check. In that state the endpoint creates a user — including an administrator — for an entirely unauthenticated caller.
This issue has been fixed in version 6.5.9.
cve.now Index
- Exploitation0/40No signal
- Exposure5/25Specific setups only
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.3/10CVSS 7.3, total technical impact per CISA
- No patch0/5No signal
What would change the score
- Would score about 63 if added to CISA KEV
- Would score about 58 if CISA's SSVC rates exploitation active
- Would score about 23 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
The users table is empty (no users exist yet).Upgrade to a fixed version: 6.5.9.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Rapid7 Metasploit Framework
fixed in 6.5.9
Evidence 1
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-121139
Is CVE-2026-121139 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
When the Web Service has no users yet, a request can create an administrator account without logging in first. The flaw sits in that initial setup window.Source: github.com
Which versions are affected by CVE-2026-121139?
Metasploit Framework: before 6.5.9.Source: cve.now feed data
Am I affected, and how do I check?
Metasploit Framework versions before 6.5.9 are listed as affected. The bug applies only while the Web Service users table is empty, so check the installed version against 6.5.9 and whether any users already exist.Source: github.com
How do I fix CVE-2026-121139?
Upgrade Metasploit Framework to 6.5.9 or later, which is the listed fixed version.Source: github.com
Why do the sources disagree?
The description says the bootstrap window allows account creation without authentication, which points to no credentials being needed. The vector string lists PR:L, which means low privileges are required. The sources conflict on whether authentication is needed.Source: github.com