---
id: CVE-2026-109682
title: Metasploit Framework HTTP Redirect Server-Side Request Forgery
summary: >-
  Metasploit Framework versions before 6.5.7 allow HTTP requests made through
  send_request_cgi! to follow redirects to a different host without restricting
  the redirect destination. A malicious HTTP server can cause the system running
  Meta…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: Rapid7
product: Metasploit Framework
affected:
  - metasploit_framework < 6.5.7
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T23:12:55.091Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109682'
references:
  - url: 'https://github.com/rapid7/metasploit-framework/pull/21979'
tags:
  - cve.org
ingestedAt: '2026-10-20T23:33:47.223Z'
---

## Overview

Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker.

## Affected

- `metasploit_framework < 6.5.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.