Metasploit adds Langflow, OpenCTI, Grafana and MongoDB modules
Original title: Metasploit Wrap Up: Langflow, MongoDB, and More
Six Langflow modules cover an auth bypass and remote code execution from 1.0.0 through 1.11.4.
Rapid7’s Metasploit wrap-up adds 11 modules, six of them for Langflow. They cover authentication bypass CVE-2026-93680, three unauthenticated remote code execution flaws and two authenticated code-execution flaws across releases from 1.0.0 through 1.11.4. Other additions chain two OpenCTI flaws for unauthenticated command execution, exploit Grafana CVE-2024-9264, disclose 4gaBoards user data, and add MongoDB and Apache Solr scanners.
Unconfirmed: Fixed versions are not stated for any of the covered products.
- Langflow 1.5.0 through 1.11.4 is affected by auth-bypass CVE-2026-93680.
- Unauthenticated RCE modules target Langflow 1.4.2, 1.3.2, and 1.0.0 through 1.9.3.
- Authenticated Langflow flaws cover 1.0.0 through 1.10.0 and 1.5.0 through 1.9.0.
- 4gaBoards 3.3.8 and below can expose every user’s contact details to any authenticated user.
- OpenCTI module chains CVE-2026-27960 and CVE-2026-39980; no fixed versions are stated.
Impact: Remote code execution and mass disclosure of user contact data
| Product | Affected |
|---|---|
| Langflow | 1.5.0 through 1.11.4 |
| Langflow | 1.0.0 through 1.10.0 |
| Langflow | 1.5.0 through 1.9.0 |
| Langflow | 1.4.2 |
| Langflow | 1.3.2 |
| Langflow | 1.0.0 through 1.9.3 |
| 4gaBoards | 3.3.8 and below |
| OpenCTI | — |
| Grafana | — |
- 1.Review Langflow 1.0.0 through 1.11.4 for the six new Metasploit exploit modules.
- 2.Check OpenCTI for the unauthenticated notifier remote-command chain.
- 3.Assess Grafana SQL Expressions exposure to public CVE-2024-9264 exploit code.
- CVEs
- CVE-2026-53959CVE-2026-93680CVE-2026-27960CVE-2026-39980CVE-2024-9264CVE-2026-7873CVE-2026-93674CVE-2026-0768CVE-2026-0769CVE-2026-10134
- Organizations
- Rapid7
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-9264 | Authenticated Command Injection & Local File Inclusion in Grafana SQL Expressions | 9.4 | 95% | ||
CVE-2026-0769+1 related CVE | Unauthenticated Eval Injection RCE in Langflow (eval_custom_component_code) | 9.8 | 41% | PoC | |
CVE-2026-10134+1 related CVE | IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and modify every flow, conversation… | 10.0 group max | <1% | ||
| CVE-2026-27960 | OpenCTI: In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated… | 9.8 | <1% | ||
| CVE-2026-39980 | OpenCTI: The safeEjs.ts file does not properly sanitize EJS templates. Users with the Manage customization capability can run arbitrary… | 7.2 | <1% | ||
| CVE-2026-53959 | 4gaBoards: 4gaBoards allows any authenticated user to enumerate account information for every user through GET /api/users and retrieve… | 6.5 | <1% | ||
| CVE-2026-93674 | Unauthenticated RCE in IBM Langflow OSS 1.0.0–1.12.2 | 9.8 | 15% | PoC | |
| CVE-2026-93680 | — | — | PoC | — |
From the original article
4 min read at rapid7.com
This release adds multiple new modules, and 6 of those modules point at a single target: Langflow, the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680), 3 unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134), and 2 authenticated code execution flaws (CVE-2026-7873 and CVE-2026-93674), spanning Langflow releases from 1. 0.
By Alan David Foster · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.