CVE-2026-109682 Metasploit Framework HTTP Redirect Server-Side Request Forgery
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-109682?
CVE-2026-109682 is a medium-severity vulnerability in Rapid7 Metasploit Framework, published on 20 Oct 2026.
Official description
Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker.
Weakness: CWE-918
Which versions are affected by CVE-2026-109682?
How do I fix CVE-2026-109682?
No fix has been published for CVE-2026-109682 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-109682 being exploited?
There is no known exploitation of CVE-2026-109682 in the wild and no public exploit code.
Sources
Also known as GHSA-77hf-v8xc-qfg4.