Threat reportVulnerabilityTL-2026-4280
Metasploit Modules Released for Six Langflow Vulnerabilities (CVE-2026-93680, CVE-2026-7873, CVE-2026-93674, CVE-2026-0768, CVE-2026-0769, CVE-2026-10134)
Metasploit Modules Released for Six Langflow Vulnerabilities (TL-2026-4280), also tracked as Metasploit Langflow modules, is a critical-severity software vulnerability scored CVSS 10, first published 2026-10-23. It has no confirmed attribution, affects Langflow / IBM Langflow OSS, references 10 CVEs (CVE-2026-93680, CVE-2026-7873, CVE-2026-93674), maps to 11 MITRE ATT&CK techniques (T1005, T1059.004, T1059.006), and is covered by 9 detection rules and 13 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 10Referenced vulnerabilities
- Techniques
- 11MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-4280
- Threat ID
- TL-2026-4280
- Also known as
- Metasploit Langflow modules
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, ai-ml, software-development, cloud-services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 13
Malware and tooling in Metasploit Modules Released for Six Langflow Vulnerabilities
Malware and tooling: Python, Metasploit Framework, Rapid7, metasploit
How Metasploit Modules Released for Six Langflow Vulnerabilities works
Rapid7's Metasploit wrap-up (2026-10-23) adds six Langflow modules: one authentication bypass, three unauthenticated RCEs (CVE-2026-0768, CVE-2026-0769, CVE-2026-10134) and two authenticated RCE/command-injection flaws. Public exploit code now exists, and third-party reporting (VulnCheck, via SecurityAffairs) documents in-the-wild exploitation of CVE-2026-0768 since 2026-09-02.
Rapid7's Metasploit Framework wrap-up published 2026-10-23 announces six new modules targeting Langflow, the open-source framework for building AI agents and workflows. The modules are: gather/langflow_auth_bypass_cve_2026_93680 (auxiliary, Langflow 1.5.0-1.11.4, PR #21942); multi/http/langflow_unauth_rce_cve_2026_0768 (Langflow 1.4.2, validate code injection, PR #21864); multi/http/langflow_unauth_rce_cve_2026_0769 (Langflow 1.3.2, custom component eval injection, PR #21867); multi/http/langflow_unauth_rce_cve_2026_10134 (Langflow 1.0.0-1.9.3, public flow build, PR #21875); multi/http/langflow_auth_rce_cve_2026_7873 (Langflow 1.0.0-1.10.0, code validation, PR #21877); and multi/http/langflow_auth_command_injection_cve_2026_93674 (Langflow 1.5.0-1.9.0, PR #21939). Rapid7 credits Richard Howe, Peter Girnus and n0k0 as module authors.
CVE-2026-0768 is a code-injection flaw in the code validator of Langflow's custom component editor: the 'code' parameter of the validate endpoint is passed to Python execution without validation, giving unauthenticated code execution in the context of the Langflow process (reported as root). It was reported through ZDI in July 2025 (Trend Research: Peter Girnus, William Gamazo Sanchez, Alfredo Oliveira), disclosed publicly in January 2026, scored CVSS 9.8, and VulnCheck Canaries observed 50+ exploitation attempts starting 2026-09-02 (later reported at 360), mainly from Russia-origin traffic. Observed post-exploitation activity was reconnaissance and credential theft: dumping environment variables (Langflow, OpenAI and AWS keys), retrieving the Langflow secret key, and inspecting SSH material and shell history. CVE-2026-0769 is an eval injection (CWE-95) in eval_custom_component_code in Langflow 1.3.2, unauthenticated, CVSS 9.8 (ZDI-CAN-26972).
CVE-2026-10134 (IBM Langflow OSS 1.0.0-1.9.3, CWE-94, CVSS 3.1 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, published 2026-07-03) is unauthenticated RCE via the PythonCodeStructuredTool component, which runs attacker-controlled Python through exec() at flow-build time. It is exploitable once any flow is marked PUBLIC: the unauthenticated endpoint /api/v1/build_public_tmp/{flow_id}/flow accepts builds with no Authorization header. Attackers can read all secrets available to Langflow, modify flows, and persist by altering the tool_code field of public flows so the code re-executes on later API calls. CVE-2026-7873 (Langflow OSS 1.0.0-1.10.0, CWE-94, CVSS 9.9, PR:L) lets an authenticated user inject OS commands through the code execution pipeline. For CVE-2026-93680 (auth bypass) and CVE-2026-93674 (authenticated command injection), the only source retrieved is the Rapid7 wrap-up; one search snippet reports CVE-2026-93674 as affecting 1.0.0-1.12.2 at CVSS 9.8 with a fix in 1.12.3, which conflicts with Rapid7's 1.5.0-1.9.0 range and was not confirmed in a primary advisory, so treat the broader range as unverified.
The same wrap-up covers modules for other products, included here for context: OpenCTI (linux/http/opencti_notifier_rce chaining CVE-2026-27960 API user-impersonation auth bypass, fixed in 6.9.13, with CVE-2026-39980 EJS template injection RCE, fixed in 6.9.5), Grafana (CVE-2024-9264 SQL Expressions/DuckDB command injection, authenticated viewer or higher, needs duckdb binary in PATH), 4gaBoards (CVE-2026-53959, authenticated mass user-info disclosure via GET /api/users, fixed in 3.3.9), plus MongoDB and Apache Solr scanner modules. No CISA KEV listing was confirmed for these CVEs. Defenders should upgrade Langflow to the latest fixed release, keep it off the internet or behind authentication, avoid public flows containing code-executing components, and rotate any secrets stored in or reachable from Langflow hosts.
MITRE ATT&CK techniques used in TL-2026-4280
Collection
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Discovery
T1082 System Information Discovery; T1087 Account Discovery
Credential Access
T1552.001 Unsecured Credentials: Credentials In Files; T1552.003 Shell History
Resource Development
T1588.005 Obtain Capabilities: Exploits
Reconnaissance
T1589.002 Gather Victim Identity Information: Email Addresses
Affected products and versions in Metasploit Modules Released for Six Langflow Vulnerabilities
- Langflow / IBM — Langflow OSS
Vulnerable versions: 1.4.2 (CVE-2026-0768); 1.3.2 (CVE-2026-0769); 1.0.0-1.9.3 (CVE-2026-10134); 1.0.0-1.10.0 (CVE-2026-7873); 1.5.0-1.9.0 (CVE-2026-93674, per Rapid7); 1.5.0-1.11.4 (CVE-2026-93680)
Fixed in: Later releases; IBM bulletins cite 1.11.2 and 1.12.3 - Filigran — OpenCTI
Vulnerable versions: 6.6.0-6.9.12 (CVE-2026-27960); before 6.9.5 (CVE-2026-39980)
Fixed in: 6.9.13; 6.9.5 - Grafana Labs — Grafana
Vulnerable versions: 11.0.x; 11.1.x; 11.2.x
Fixed in: 11.0.6+security-01; 11.1.7+security-01; 11.2.2+security-01 - 4ga — 4gaBoards
Vulnerable versions: 3.3.8 and below
Fixed in: 3.3.9
Remediation for Metasploit Modules Released for Six Langflow Vulnerabilities
Patches
- Upgrade Langflow OSS to the latest release; IBM guidance for the multi-CVE bulletins points to 1.11.2 and 1.12.3 as fixed builds
- Upgrade OpenCTI to 6.9.13 or later; upgrade 4gaBoards to 3.3.9 or later; apply Grafana 11.0.6/11.1.7/11.2.2+security-01 or later
Immediate actions
- Remove Langflow instances from direct internet exposure or place them behind authenticated reverse proxy/VPN
- Rotate Langflow secret keys, OpenAI/LLM provider keys, AWS credentials and any other secrets present in Langflow environment variables
- Review flows marked PUBLIC and their tool_code/custom component fields for unexpected Python
- Hunt for requests to the validate-code endpoint, /api/v1/build_public_tmp/*/flow and PATCH /api/v1/flows/* setting access_type PUBLIC
Workarounds
- Do not mark flows PUBLIC while running a vulnerable version
- Do not install the duckdb binary on Grafana hosts or disable SQL Expressions
Longer-term hardening
- Run Langflow as an unprivileged user in a sandboxed container with minimal secrets and restricted egress
- Alert on Python child processes spawning shells or reading ~/.ssh and shell history from the Langflow service account
CVEs associated with Metasploit Modules Released for Six Langflow Vulnerabilities
CVE-2026-93680, CVE-2026-7873, CVE-2026-93674, CVE-2026-0768, CVE-2026-0769, CVE-2026-10134, CVE-2026-53959, CVE-2026-27960, CVE-2026-39980, CVE-2024-9264
Weaknesses (CWE) in Metasploit Modules Released for Six Langflow Vulnerabilities
Timeline of Metasploit Modules Released for Six Langflow Vulnerabilities
- CVE-2026-0768 reported to the vendor through ZDI by Trend Research (month-level date: July 2025)
- CVE-2026-0768 publicly disclosed (month-level date: January 2026)
- CVE-2026-10134 (CVSS 10.0) and CVE-2026-7873 (CVSS 9.9) published for Langflow OSS
- VulnCheck Canaries record first exploitation of CVE-2026-0768 (50+ detections, mostly Russia-origin traffic); attackers dump environment variables, Langflow secret key, SSH and shell history
- CVE-2026-93674 publicly recorded, per secondary source; IBM bulletin recommends Langflow 1.12.3
- Rapid7 announces six Metasploit Langflow modules (auth bypass CVE-2026-93680, unauthenticated RCEs CVE-2026-0768/0769/10134, authenticated CVE-2026-7873/93674) plus OpenCTI, Grafana, 4gaBoards, MongoDB and Solr modules
Sources cited for Metasploit Modules Released for Six Langflow Vulnerabilities
- Metasploit Wrap Up: Langflow, MongoDB, and More (Rapid7)
- Metasploit Framework Repository
- Hackers Target Langflow in CVE-2026-0768 Attacks (Security Affairs)
- Critical Langflow flaw exploited to steal OpenAI and AWS keys (BleepingComputer)
- CVE-2026-10134 (SentinelOne vulnerability database)
- CVE-2026-7873 (SentinelOne vulnerability database)
- IBM Support: Langflow OSS CVE-2026-10134
- IBM Support: Langflow OSS CVE-2026-7873
- Tenable: CVE-2026-0769
- OpenCTI CVE-2026-27960 unauthenticated API impersonation (ZeroPath)
- CVE-2026-39980 (OSV)
- CVE-2026-53959 4gaBoards (OSV)
- NVD: CVE-2024-9264 Grafana
Detection coverage for TL-2026-4280
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4280 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.