Metasploit Wrap Up: Langflow, MongoDB, and More
MentionsApache Software FoundationGitHub
This release adds multiple new modules, and 6 of those modules point at a single target: Langflow , the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680), 3 unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134), and 2 authenticated code execution flaws (CVE-2026-7873 and CVE-2026-93674), spanning Langflow releases from 1.0.0…
Summary from Rapid7 Blog.
Explained
The technology and terms in this story. Learn more
- TechnologyLLM · Large language modelAn AI model trained on huge amounts of text to understand and generate language, such as ChatGPT or Claude.
- WeaknessAuthentication bypassA flaw that lets someone in without valid credentials.
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.