CVE-2026-7373

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-7373
Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing "vagrant" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to create it. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits the unprivileged vagrant user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.
CVSS

No CVSS.

References
Link Resource
https://docs.rapid7.com/insight/release-notes-5.0.0-2026051301/#:~:text=Pro%3A%20We%20fixed,vulnerability%20to%20Rapid7.
Configurations

No configuration.

History

19 May 2026, 23:16

Type Values Removed Values Added
Summary (en) Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows users to gain SYSTEM level control of a Windows host. Upon startup the metasploitPostgreSQL service the subsequent postgres.exe service attempts to load an OpenSSL configuration file from a non-existent directory that is writable by standard users. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits an unprivileged user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access. (en) Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing "vagrant" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to create it. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits the unprivileged vagrant user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.

18 May 2026, 02:16

Type Values Removed Values Added
References
  • {'url': 'https://docs.rapid7.com/insight/metasploit-pro-release-notes/', 'source': 'cve@rapid7.com'}
  • () https://docs.rapid7.com/insight/release-notes-5.0.0-2026051301/#:~:text=Pro%3A%20We%20fixed,vulnerability%20to%20Rapid7. -

15 May 2026, 03:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-15 03:16

Updated : 2026-05-19 23:16

NVD link : CVE-2026-7373

Mitre link : CVE-2026-7373

CVE.ORG link : CVE-2026-7373

JSON object : View

Products Affected

No product.

CWE
CWE-284

Improper Access Control

CWE-427

Uncontrolled Search Path Element

CWE-829

Inclusion of Functionality from Untrusted Control Sphere