# Metasploit Modules Released for Six Langflow Vulnerabilities (CVE-2026-93680, CVE-2026-7873, CVE-2026-93674, CVE-2026-0768, CVE-2026-0769, CVE-2026-10134)

> Rapid7's Metasploit wrap-up (2026-10-23) adds six Langflow modules: one authentication bypass, three unauthenticated RCEs (CVE-2026-0768, CVE-2026-0769, CVE-2026-10134) and two authenticated RCE/command-injection flaws. Public exploit code now exists, and third-party reporting (VulnCheck, via SecurityAffairs) documents in-the-wild exploitation of CVE-2026-0768 since 2026-09-02.

- **Published:** 2026-10-23T16:22:07Z
- **Last reviewed:** 2026-10-23T16:22:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4280
- **ID:** TL-2026-4280
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-93680, CVE-2026-7873, CVE-2026-93674, CVE-2026-0768, CVE-2026-0769, CVE-2026-10134, CVE-2026-53959, CVE-2026-27960, CVE-2026-39980, CVE-2024-9264

## Description

Rapid7's Metasploit Framework wrap-up published 2026-10-23 announces six new modules targeting Langflow, the open-source framework for building AI agents and workflows. The modules are: gather/langflow_auth_bypass_cve_2026_93680 (auxiliary, Langflow 1.5.0-1.11.4, PR #21942); multi/http/langflow_unauth_rce_cve_2026_0768 (Langflow 1.4.2, validate code injection, PR #21864); multi/http/langflow_unauth_rce_cve_2026_0769 (Langflow 1.3.2, custom component eval injection, PR #21867); multi/http/langflow_unauth_rce_cve_2026_10134 (Langflow 1.0.0-1.9.3, public flow build, PR #21875); multi/http/langflow_auth_rce_cve_2026_7873 (Langflow 1.0.0-1.10.0, code validation, PR #21877); and multi/http/langflow_auth_command_injection_cve_2026_93674 (Langflow 1.5.0-1.9.0, PR #21939). Rapid7 credits Richard Howe, Peter Girnus and n0k0 as module authors.

CVE-2026-0768 is a code-injection flaw in the code validator of Langflow's custom component editor: the 'code' parameter of the validate endpoint is passed to Python execution without validation, giving unauthenticated code execution in the context of the Langflow process (reported as root). It was reported through ZDI in July 2025 (Trend Research: Peter Girnus, William Gamazo Sanchez, Alfredo Oliveira), disclosed publicly in January 2026, scored CVSS 9.8, and VulnCheck Canaries observed 50+ exploitation attempts starting 2026-09-02 (later reported at 360), mainly from Russia-origin traffic. Observed post-exploitation activity was reconnaissance and credential theft: dumping environment variables (Langflow, OpenAI and AWS keys), retrieving the Langflow secret key, and inspecting SSH material and shell history. CVE-2026-0769 is an eval injection (CWE-95) in eval_custom_component_code in Langflow 1.3.2, unauthenticated, CVSS 9.8 (ZDI-CAN-26972).

CVE-2026-10134 (IBM Langflow OSS 1.0.0-1.9.3, CWE-94, CVSS 3.1 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, published 2026-07-03) is unauthenticated RCE via the PythonCodeStructuredTool component, which runs attacker-controlled Python through exec() at flow-build time. It is exploitable once any flow is marked PUBLIC: the unauthenticated endpoint /api/v1/build_public_tmp/{flow_id}/flow accepts builds with no Authorization header. Attackers can read all secrets available to Langflow, modify flows, and persist by altering the tool_code field of public flows so the code re-executes on later API calls. CVE-2026-7873 (Langflow OSS 1.0.0-1.10.0, CWE-94, CVSS 9.9, PR:L) lets an authenticated user inject OS commands through the code execution pipeline. For CVE-2026-93680 (auth bypass) and CVE-2026-93674 (authenticated command injection), the only source retrieved is the Rapid7 wrap-up; one search snippet reports CVE-2026-93674 as affecting 1.0.0-1.12.2 at CVSS 9.8 with a fix in 1.12.3, which conflicts with Rapid7's 1.5.0-1.9.0 range and was not confirmed in a primary advisory, so treat the broader range as unverified.

The same wrap-up covers modules for other products, included here for context: OpenCTI (linux/http/opencti_notifier_rce chaining CVE-2026-27960 API user-impersonation auth bypass, fixed in 6.9.13, with CVE-2026-39980 EJS template injection RCE, fixed in 6.9.5), Grafana (CVE-2024-9264 SQL Expressions/DuckDB command injection, authenticated viewer or higher, needs duckdb binary in PATH), 4gaBoards (CVE-2026-53959, authenticated mass user-info disclosure via GET /api/users, fixed in 3.3.9), plus MongoDB and Apache Solr scanner modules. No CISA KEV listing was confirmed for these CVEs. Defenders should upgrade Langflow to the latest fixed release, keep it off the internet or behind authentication, avoid public flows containing code-executing components, and rotate any secrets stored in or reachable from Langflow hosts.

## MITRE ATT&CK

- T1588.005 Obtain Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.006 Command and Scripting Interpreter: Python
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.003 Shell History
- T1082 System Information Discovery
- T1087 Account Discovery
- T1005 Data from Local System
- T1589.002 Gather Victim Identity Information: Email Addresses

## Sources

- [Metasploit Wrap Up: Langflow, MongoDB, and More (Rapid7)](https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-langflow-mongodb-and-more)
- [Metasploit Framework Repository](https://github.com/rapid7/metasploit-framework)
- [Hackers Target Langflow in CVE-2026-0768 Attacks (Security Affairs)](https://securityaffairs.com/198270/hacking/hackers-target-langflow-in-cve-2026-0768-attacks.html)
- [Critical Langflow flaw exploited to steal OpenAI and AWS keys (BleepingComputer)](https://bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys)
- [CVE-2026-10134 (SentinelOne vulnerability database)](https://www.sentinelone.com/vulnerability-database/cve-2026-10134/)
- [CVE-2026-7873 (SentinelOne vulnerability database)](https://www.sentinelone.com/vulnerability-database/cve-2026-7873/)
- [IBM Support: Langflow OSS CVE-2026-10134](https://ibm.com/support/pages/node/7277559)
- [IBM Support: Langflow OSS CVE-2026-7873](https://www.ibm.com/support/pages/node/7278441)
- [Tenable: CVE-2026-0769](https://www.tenable.com/cve/CVE-2026-0769)
- [OpenCTI CVE-2026-27960 unauthenticated API impersonation (ZeroPath)](https://zeropath.com/blog/cve-2026-27960-opencti-unauthenticated-api-impersonation)
- [CVE-2026-39980 (OSV)](https://osv.dev/vulnerability/CVE-2026-39980)
- [CVE-2026-53959 4gaBoards (OSV)](https://osv.dev/vulnerability/CVE-2026-53959)
- [NVD: CVE-2024-9264 Grafana](https://nvd.nist.gov/vuln/detail/CVE-2024-9264)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4280