Vulnerability · Published Oct 20, 2026 · Assigned by rapid7
CVE-2026-109681Metasploit Framework FTP PASV Response SSRF
Medium 4.7
In plain English
A medium-severity server-side request forgery in Metasploit Framework from Rapid7. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.2%top 89.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rapid7 | Metasploit Framework | 0 – before 6.5.7 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
References
- https://github.com/rapid7/metasploit-framework/pull/21994 patch, release-notes