Metasploit Wrap Up: Langflow, MongoDB, and More

This release adds multiple new modules, and 6 of those modules point at a single target: Langflow , the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680), 3 unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134), and 2 authenticated code execution flaws (CVE-2026-7873 and CVE-2026-93674), spanning Langflow releases from 1.0.0…

Summary from Rapid7 Blog.

Vulnerabilities in this story

Severity and exploitation facts from NVD, FIRST, and CISA.

• CVE-2026-10134Critical 10.0EPSS 1.6%
• CVE-2026-7873Critical 9.9EPSS 1.1%
• CVE-2026-0768Critical 9.8EPSS 23.1%
• CVE-2026-0769Critical 9.8EPSS 41.2%
• CVE-2026-93674Critical 9.8EPSS 6.2%
• CVE-2026-53959Medium 6.5EPSS 1.0%
• CVE-2026-93680CVSS unavailable

More in AppSec