{"slug": "metasploit-wrap-up-langflow-mongodb-and-more", "title": "Metasploit Wrap Up: Langflow, MongoDB, and More", "summary": "Rapid7's Metasploit Framework added six new modules targeting Langflow, the open-source LLM workflow builder, covering an authentication bypass (CVE-2026-93680), three unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, CVE-2026-10134) and two authenticated code execution flaws (CVE-2026-7873, CVE-2026-93674) across Langflow releases 1.0.0 through 1.11.4. The release, credited to contributor rmhowe425 with research by Peter Girnus and n0k0, also adds a pre-auth RCE chain against OpenCTI from kmkz, three MongoDB auxiliary modules plus an Apache Solr version scanner from h00die, and an authenticated DuckDB command injection exploit for Grafana (CVE-2024-9264). The modules give penetration testers and defenders working exploit code for flaws in AI workflow tooling that is increasingly deployed inside enterprise networks.", "body_md": "This release adds multiple new modules, and 6 of those modules point at a single target: [Langflow](https://www.langflow.org/), the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680), 3 unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134), and 2 authenticated code execution flaws (CVE-2026-7873 and CVE-2026-93674), spanning Langflow releases from 1.0.0 through 1.11.4. Thanks to the work of [rmhowe425](https://github.com/rmhowe425), with research credit to Peter Girnus and n0k0. Beyond Langflow, open source contributor [kmkz](https://github.com/kmkz) contributed a pre-auth RCE chain against OpenCTI. MongoDB coverage has also been expanded with 3 new auxiliary modules plus an Apache Solr version scanner thanks to the work of community member [h00die](https://github.com/h00die).\n\nAuthors: Balachandar Gowrisankar, de3erve (GitHub), and lucquach (GitHub)\n\nType: Auxiliary\n\nPull request: [#21831](https://github.com/rapid7/metasploit-framework/pull/21831) contributed by [anirbala98](https://github.com/anirbala98)\n\nPath: gather/4gaboards_users_info_disclosure_cve_2026_53959\n\nCVE reference: [CVE-2026-53959](https://www.rapid7.com/db/vulnerabilities/cve-2026-53959/)\n\nDescription: Adds a module that exploits CVE-2026-53959, a broken access control vulnerability allowing mass user information disclosure in 4gaBoards versions 3.3.8 and below. The application's /api/users REST endpoint lets any authenticated user retrieve a full, unpaginated list of every user in the system. Missing authorization checks allow an attacker to retrieve the email, phone, organization, name, and SSO email addresses (ssoGoogleEmail, ssoGithubEmail, and others) of every user.\n\nAuthor: Richard Howe\n\nPull request: [#21942](https://github.com/rapid7/metasploit-framework/pull/21942) contributed by [rmhowe425](https://github.com/rmhowe425)\n\nPath: gather/langflow_auth_bypass_cve_2026_93680\n\nCVE reference: [CVE-2026-93680](https://www.rapid7.com/db/vulnerabilities/cve-2026-93680/)\n\nDescription: Adds a new auxiliary module that leverages CVE-2026-93680, an authentication bypass vulnerability impacting Langflow versions 1.5.0 through 1.11.4.\n\nAuthor: h00die\n\nPull request: [#22006](https://github.com/rapid7/metasploit-framework/pull/22006) contributed by [h00die](https://github.com/h00die)\n\nPath: scanner/http/apache_solr_version\n\nDescription: Adds a new scanner that identifies Apache Solr and reports its version.\n\nAuthors: h00die and prithvee07\n\nPull request: [#21785](https://github.com/rapid7/metasploit-framework/pull/21785) contributed by [h00die](https://github.com/h00die)\n\nDescription: Adds the mongodb_version, mongodb_schemadump, and mongodb_hashdump auxiliary modules, and updates the existing mongodb_login module.\n\nThis PR adds the following modules:\n\nAuthor: Jean-Marie Bourbon\n\nType: Exploit\n\nPull request: [#21826](https://github.com/rapid7/metasploit-framework/pull/21826) contributed by [kmkz](https://github.com/kmkz)\n\nPath: linux/http/opencti_notifier_rce\n\nCVE references: [CVE-2026-27960](https://www.rapid7.com/db/vulnerabilities/cve-2026-27960/) and [CVE-2026-39980](https://www.rapid7.com/db/vulnerabilities/cve-2026-39980/)\n\nDescription: Adds a new exploit module for OpenCTI that chains CVE-2026-27960 and CVE-2026-39980 to achieve unauthenticated remote command execution.\n\nAuthor: Özcan Ersan (@ozcanpng)\n\nPull request: [#21901](https://github.com/rapid7/metasploit-framework/pull/21901) contributed by [ozcanpng](https://github.com/ozcanpng)\n\nPath: multi/http/grafana_sql_expressions_rce_cve_2024_9264\n\nCVE reference: [CVE-2024-9264](https://www.rapid7.com/db/vulnerabilities/cve-2024-9264/)\n\nDescription: Adds an authenticated exploit module for CVE-2024-9264, a DuckDB command injection in Grafana SQL Expressions.\n\nAuthors: Richard Howe and n0k0\n\nPull request: [#21877](https://github.com/rapid7/metasploit-framework/pull/21877) contributed by [rmhowe425](https://github.com/rmhowe425)\n\nPath: multi/http/langflow_auth_rce_cve_2026_7873\n\nCVE reference: [CVE-2026-7873](https://www.rapid7.com/db/vulnerabilities/cve-2026-7873/)\n\nDescription: Adds a new exploit module that detects and exploits CVE-2026-7873, an authenticated RCE vulnerability impacting Langflow versions 1.0.0 through 1.10.0.\n\nPull request: [#21939](https://github.com/rapid7/metasploit-framework/pull/21939) contributed by [rmhowe425](https://github.com/rmhowe425)\n\nPath: multi/http/langflow_auth_command_injection_cve_2026_93674\n\nCVE reference: [CVE-2026-93674](https://www.rapid7.com/db/vulnerabilities/cve-2026-93674/)\n\nDescription: Adds a new exploit module that detects and exploits CVE-2026-93674, an authenticated blind command injection vulnerability impacting Langflow versions 1.5.0 through 1.9.0.\n\nAuthors: Peter Girnus and Richard Howe\n\nPull request: [#21864](https://github.com/rapid7/metasploit-framework/pull/21864) contributed by [rmhowe425](https://github.com/rmhowe425)\n\nPath: multi/http/langflow_unauth_rce_cve_2026_0768\n\nCVE reference: [CVE-2026-0768](https://www.rapid7.com/db/vulnerabilities/cve-2026-0768/)\n\nDescription: Adds a new exploit module that detects and exploits CVE-2026-0768, an unauthenticated remote code execution vulnerability impacting Langflow version 1.4.2.\n\nPull request: [#21867](https://github.com/rapid7/metasploit-framework/pull/21867) contributed by [rmhowe425](https://github.com/rmhowe425)\n\nPath: multi/http/langflow_unauth_rce_cve_2026_0769\n\nCVE reference: [CVE-2026-0769](https://www.rapid7.com/db/vulnerabilities/cve-2026-0769/)\n\nDescription: Adds a new exploit module that detects and exploits CVE-2026-0769, an unauthenticated RCE vulnerability impacting Langflow version 1.3.2.\n\nPull request: [#21875](https://github.com/rapid7/metasploit-framework/pull/21875) contributed by [rmhowe425](https://github.com/rmhowe425)\n\nPath: multi/http/langflow_unauth_rce_cve_2026_10134\n\nCVE reference: [CVE-2026-10134](https://www.rapid7.com/db/vulnerabilities/cve-2026-10134/)\n\nDescription: Adds a new exploit module that detects and exploits CVE-2026-10134, an unauthenticated remote code execution vulnerability impacting Langflow versions 1.0.0 through 1.9.3.\n\nYou can find the latest Metasploit documentation on our docsite at [docs.metasploit.com](https://docs.metasploit.com/).\n\nAs always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:\n\nIf you are a git user, you can clone the [Metasploit Framework repo](https://github.com/rapid7/metasploit-framework) (master branch) for the latest. To install fresh without using git, you can use the open-source-only [Nightly Installers](https://github.com/rapid7/metasploit-framework/wiki/Nightly-Installers) or the commercial edition [Metasploit Pro](https://www.rapid7.com/products/metasploit/download/)", "url": "https://wpnews.pro/news/metasploit-wrap-up-langflow-mongodb-and-more", "canonical_source": "https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-langflow-mongodb-and-more", "published_at": "2026-10-23 15:38:56+00:00", "updated_at": "2026-11-06 16:22:46.658071+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "artificial-intelligence"], "entities": ["Rapid7", "Metasploit Framework", "Langflow", "OpenCTI", "MongoDB", "Apache Solr", "Grafana", "DuckDB"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/metasploit-wrap-up-langflow-mongodb-and-more", "markdown": "https://wpnews.pro/news/metasploit-wrap-up-langflow-mongodb-and-more.md", "text": "https://wpnews.pro/news/metasploit-wrap-up-langflow-mongodb-and-more.txt", "jsonld": "https://wpnews.pro/news/metasploit-wrap-up-langflow-mongodb-and-more.jsonld"}}