CVE-2026-109682 affects Metasploit Framework versions before 6.5.7, where HTTP requests issued through the send_request_cgi method will follow redirects to any host without checking the destination. A rogue or compromised HTTP server could exploit this to make the machine running Metasploit send requests into internal services on the operator's own network that the attacker couldn't otherwise reach. Users should upgrade to a patched release to close the gap.
// source: nvd.nist.gov ↗