Description
Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing "vagrant" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to create it. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits the unprivileged vagrant user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.
Problem types
CWE-829 Inclusion of Functionality from Untrusted Control Sphere
CWE-427 Uncontrolled Search Path Element
CWE-284 Improper Access Control
Product status
5.0.0 (custom)
Timeline
| 2026-04-23: | Vulnerability reported to Rapid7 |
| 2026-04-24: | Rapid7 acknowledged receipt and confirmed remediation in progress |
| 2026-04-28: | CVE-2026-7373 reserved |
| 2026-05-14: | CVE record updated |
Credits
Andrea Intilangelo
References
docs.rapid7.com/insight/release-notes-5.0.0-2026051301/ (Similar CVE Reference)