The Metasploit Framework Web Service REST API exposed its credential store without enforcing authentication on the update and delete handlers for credentials. When an attacker can reach the service on the default 0.0.0.0:8080 port, they can invoke these endpoints and read, modify, or permanently delete any stored credential record—including passwords, hash values, and private keys—without providing any credentials. This flaw aligns with CWE‑306, “Missing Authentication for Critical Functionality.” The lack of authorization can lead to confidentiality loss of sensitive credential data and facilitate further attacks by using those credentials.

The vulnerability affects all versions of the Rapid7 Metasploit Framework prior to 6.5.5 that deploy the msf-ws service. All publicly released versions up to 6.5.4 are impacted, regardless of configuration, as the API routes that lack authentication remain active when the service listens on any network interface.

The CVSS score of 9.8 indicates a critical severity. Attackers only need network connectivity to the msf-ws service and no user credentials; the API accepts any requester due to the missing warden.authenticate! call. Although the EPSS score is not available and the flaw is not listed in CISA KEV, the combination of high severity and trivial user prerequisites makes it highly exploitable, especially if the web service is exposed to untrusted networks.