Metasploit Wrap Up: Langflow, MongoDB, and More

Rapid7's Metasploit Framework added six new modules targeting Langflow, the open-source LLM workflow builder, covering an authentication bypass (CVE-2026-93680), three unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, CVE-2026-10134) and two authenticated code execution flaws (CVE-2026-7873, CVE-2026-93674) across Langflow releases 1.0.0 through 1.11.4. The release, credited to contributor rmhowe425 with research by Peter Girnus and n0k0, also adds a pre-auth RCE chain against OpenCTI from kmkz, three MongoDB auxiliary modules plus an Apache Solr version scanner from h00die, and an authenticated DuckDB command injection exploit for Grafana (CVE-2024-9264). The modules give penetration testers and defenders working exploit code for flaws in AI workflow tooling that is increasingly deployed inside enterprise networks.

This release adds multiple new modules, and 6 of those modules point at a single target: Langflow https://www.langflow.org/ , the open-source LLM workflow builder. Together they cover an authentication bypass CVE-2026-93680 , 3 unauthenticated remote code execution paths CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134 , and 2 authenticated code execution flaws CVE-2026-7873 and CVE-2026-93674 , spanning Langflow releases from 1.0.0 through 1.11.4. Thanks to the work of rmhowe425 https://github.com/rmhowe425 , with research credit to Peter Girnus and n0k0. Beyond Langflow, open source contributor kmkz https://github.com/kmkz contributed a pre-auth RCE chain against OpenCTI. MongoDB coverage has also been expanded with 3 new auxiliary modules plus an Apache Solr version scanner thanks to the work of community member h00die https://github.com/h00die . Authors: Balachandar Gowrisankar, de3erve GitHub , and lucquach GitHub Type: Auxiliary Pull request: 21831 https://github.com/rapid7/metasploit-framework/pull/21831 contributed by anirbala98 https://github.com/anirbala98 Path: gather/4gaboards users info disclosure cve 2026 53959 CVE reference: CVE-2026-53959 https://www.rapid7.com/db/vulnerabilities/cve-2026-53959/ Description: Adds a module that exploits CVE-2026-53959, a broken access control vulnerability allowing mass user information disclosure in 4gaBoards versions 3.3.8 and below. The application's /api/users REST endpoint lets any authenticated user retrieve a full, unpaginated list of every user in the system. Missing authorization checks allow an attacker to retrieve the email, phone, organization, name, and SSO email addresses ssoGoogleEmail, ssoGithubEmail, and others of every user. Author: Richard Howe Pull request: 21942 https://github.com/rapid7/metasploit-framework/pull/21942 contributed by rmhowe425 https://github.com/rmhowe425 Path: gather/langflow auth bypass cve 2026 93680 CVE reference: CVE-2026-93680 https://www.rapid7.com/db/vulnerabilities/cve-2026-93680/ Description: Adds a new auxiliary module that leverages CVE-2026-93680, an authentication bypass vulnerability impacting Langflow versions 1.5.0 through 1.11.4. Author: h00die Pull request: 22006 https://github.com/rapid7/metasploit-framework/pull/22006 contributed by h00die https://github.com/h00die Path: scanner/http/apache solr version Description: Adds a new scanner that identifies Apache Solr and reports its version. Authors: h00die and prithvee07 Pull request: 21785 https://github.com/rapid7/metasploit-framework/pull/21785 contributed by h00die https://github.com/h00die Description: Adds the mongodb version, mongodb schemadump, and mongodb hashdump auxiliary modules, and updates the existing mongodb login module. This PR adds the following modules: Author: Jean-Marie Bourbon Type: Exploit Pull request: 21826 https://github.com/rapid7/metasploit-framework/pull/21826 contributed by kmkz https://github.com/kmkz Path: linux/http/opencti notifier rce CVE references: CVE-2026-27960 https://www.rapid7.com/db/vulnerabilities/cve-2026-27960/ and CVE-2026-39980 https://www.rapid7.com/db/vulnerabilities/cve-2026-39980/ Description: Adds a new exploit module for OpenCTI that chains CVE-2026-27960 and CVE-2026-39980 to achieve unauthenticated remote command execution. Author: Özcan Ersan @ozcanpng Pull request: 21901 https://github.com/rapid7/metasploit-framework/pull/21901 contributed by ozcanpng https://github.com/ozcanpng Path: multi/http/grafana sql expressions rce cve 2024 9264 CVE reference: CVE-2024-9264 https://www.rapid7.com/db/vulnerabilities/cve-2024-9264/ Description: Adds an authenticated exploit module for CVE-2024-9264, a DuckDB command injection in Grafana SQL Expressions. Authors: Richard Howe and n0k0 Pull request: 21877 https://github.com/rapid7/metasploit-framework/pull/21877 contributed by rmhowe425 https://github.com/rmhowe425 Path: multi/http/langflow auth rce cve 2026 7873 CVE reference: CVE-2026-7873 https://www.rapid7.com/db/vulnerabilities/cve-2026-7873/ Description: Adds a new exploit module that detects and exploits CVE-2026-7873, an authenticated RCE vulnerability impacting Langflow versions 1.0.0 through 1.10.0. Pull request: 21939 https://github.com/rapid7/metasploit-framework/pull/21939 contributed by rmhowe425 https://github.com/rmhowe425 Path: multi/http/langflow auth command injection cve 2026 93674 CVE reference: CVE-2026-93674 https://www.rapid7.com/db/vulnerabilities/cve-2026-93674/ Description: Adds a new exploit module that detects and exploits CVE-2026-93674, an authenticated blind command injection vulnerability impacting Langflow versions 1.5.0 through 1.9.0. Authors: Peter Girnus and Richard Howe Pull request: 21864 https://github.com/rapid7/metasploit-framework/pull/21864 contributed by rmhowe425 https://github.com/rmhowe425 Path: multi/http/langflow unauth rce cve 2026 0768 CVE reference: CVE-2026-0768 https://www.rapid7.com/db/vulnerabilities/cve-2026-0768/ Description: Adds a new exploit module that detects and exploits CVE-2026-0768, an unauthenticated remote code execution vulnerability impacting Langflow version 1.4.2. Pull request: 21867 https://github.com/rapid7/metasploit-framework/pull/21867 contributed by rmhowe425 https://github.com/rmhowe425 Path: multi/http/langflow unauth rce cve 2026 0769 CVE reference: CVE-2026-0769 https://www.rapid7.com/db/vulnerabilities/cve-2026-0769/ Description: Adds a new exploit module that detects and exploits CVE-2026-0769, an unauthenticated RCE vulnerability impacting Langflow version 1.3.2. Pull request: 21875 https://github.com/rapid7/metasploit-framework/pull/21875 contributed by rmhowe425 https://github.com/rmhowe425 Path: multi/http/langflow unauth rce cve 2026 10134 CVE reference: CVE-2026-10134 https://www.rapid7.com/db/vulnerabilities/cve-2026-10134/ Description: Adds a new exploit module that detects and exploits CVE-2026-10134, an unauthenticated remote code execution vulnerability impacting Langflow versions 1.0.0 through 1.9.3. You can find the latest Metasploit documentation on our docsite at docs.metasploit.com https://docs.metasploit.com/ . As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub: If you are a git user, you can clone the Metasploit Framework repo https://github.com/rapid7/metasploit-framework master branch for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers https://github.com/rapid7/metasploit-framework/wiki/Nightly-Installers or the commercial edition Metasploit Pro https://www.rapid7.com/products/metasploit/download/