Metasploit Ships Six Exploit Modules for Langflow

Rapid7’s latest Metasploit release adds six exploit modules targeting Langflow, the open-source LLM workflow builder. Five of those modules cover confirmed, critical-severity remote code execution flaws spanning the platform’s 1.x release history.

The highest-severity flaw, CVE-2026-10134, carries a CVSS score of 10.0. It allows unauthenticated code execution through the public flow build endpoint and affects versions 1.0.0 through 1.9.3. CVE-2026-7873 (CVSS 9.9) targets the code validation endpoint and permits authenticated code execution across versions 1.0.0 through 1.10.0. Two more unauthenticated paths, CVE-2026-0768 (CVSS 9.8) and CVE-2026-0769 (CVSS 9.8), cover the code validation and custom component evaluation surfaces in earlier branches. CVE-2026-93674 (CVSS 9.8) is an authenticated blind command injection affecting versions 1.5.0 through 1.9.0.

The release also adds modules for OpenCTI, 4gaBoards, and Grafana’s CVE-2024-9264, a CVSS 9.9 command injection via DuckDB SQL expressions available to authenticated users.

What this means for Langflow operators

A Metasploit module changes the practical picture. These vulnerabilities are no longer research items; they are accessible to any attacker running a standard framework. The two unauthenticated paths, CVE-2026-10134 and CVE-2026-0768 in particular, require no credentials against an exposed instance.

Context matters here. CVE-2026-0768 is already listed as exploited in the wild with active attacks documented since September. CISA added multiple Langflow CVEs to its Known Exploited Vulnerabilities catalog across several rounds this year. October brought 1,400-plus recorded attacks against a separate critical flaw, and a public proof-of-concept for a 9.8-scored unauth RCE circulated in August.

The pattern is one security engineers recognize from other tooling waves. A product gets adopted fast by teams focused on building rather than hardening. It ships with code execution surfaces that weren’t designed for hostile network exposure. Patches arrive incrementally, spread across multiple version branches, which makes tracking remediation harder than a clean cut-over would be. Each new disclosure lands on a base of users who haven’t finished patching the last one.

Langflow is not the only AI workflow platform with this record, but it is the one with the largest publicly available exploit collection at the moment. Update to the latest release or remove the service from network-accessible infrastructure.