Anyone running an exposed Langflow server just lost a lot of breathing room. The latest Metasploit Framework release, detailed by Rapid7's Alan David Foster in the weekly Metasploit wrap-up, adds six modules aimed at Langflow, the open-source tool developers use to wire large language models, prompts and data sources into AI agent workflows.
Together the six cover an authentication bypass, three unauthenticated remote code execution (RCE) paths, meaning an attacker can run commands on the server without logging in, and two RCE flaws that need valid credentials. Rapid7 says they span Langflow releases from 1.0.0 through 1.11.4. Metasploit is the most widely used open-source exploitation framework, so a module landing there turns a CVE from a write-up into a point-and-click attack for penetration testers and criminals alike.
Three ways in without a password
Per the release notes, the unauthenticated RCE modules are:
- CVE-2026-10134, a public flow build RCE affecting Langflow 1.0.0 through 1.9.3, the widest range of the batch.
- CVE-2026-0768, a code validation injection RCE affecting Langflow 1.4.2.
- CVE-2026-0769, a custom component eval injection RCE affecting Langflow 1.3.2.
A fourth module uses CVE-2026-93680, an authentication bypass in Langflow 1.5.0 through 1.11.4. The two authenticated exploits target CVE-2026-7873, a code validation RCE in 1.0.0 through 1.10.0, and CVE-2026-93674, a blind command injection the module targets in 1.5.0 through 1.9.0. The NVD record for CVE-2026-93674 rates it CVSS 9.8 and lists a wider affected range, IBM Langflow OSS 1.0.0 through 1.12.2. No CVSS scores are published for the other five in Rapid7's post.
The Langflow modules were contributed by Richard Howe (rmhowe425), with research credit to Peter Girnus and n0k0. The same release also adds an exploit from contributor kmkz (Jean-Marie Bourbon) that chains CVE-2026-27960 and CVE-2026-39980 for unauthenticated command execution on OpenCTI, the open-source threat intelligence platform, which security teams running it should treat as a prompt to check their own version.
Why AI workflow builders keep turning up
Langflow has been here before. In August, CISA added an earlier Langflow flaw to its catalog of exploited vulnerabilities, as we reported at the time. Tools like this typically hold API keys for model providers, database credentials and connections to internal data, which makes the server running them a valuable foothold. Rapid7 does not report in-the-wild exploitation of these six CVEs, but public, maintained exploit code shortens the gap between disclosure and attack, a pattern seen with earlier Metasploit releases.
Update Langflow and keep it off the open internet
Rapid7's post does not name fixed versions, and the NVD entry for CVE-2026-93674 marks releases through 1.12.2 as affected, so check the Langflow project's own advisories for the patched release before assuming an instance is safe. In the meantime, do not expose Langflow directly to the internet, put it behind authentication and a VPN or reverse proxy, and rotate API keys and credentials stored in flows on any server that was reachable from outside. Because the new modules can detect vulnerable instances, a sanctioned internal test is a quick way to confirm exposure.
The AI tooling boom has put a new class of powerful, credential-rich server on corporate networks, and the standard attacker toolkit is now catching up with it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.