Metasploit adds six Langflow modules, including authenticated command injection
Rapid7's Metasploit release covers an auth bypass, three unauthenticated RCE paths and two authenticated code execution flaws in the open-source LLM workflow builder.
Rapid7's Metasploit framework added 11 modules in a release described in an October 23 wrap-up post, and six of them target Langflow, the open-source LLM workflow builder. The post says the modules cover an authentication bypass, three unauthenticated remote code execution paths and two authenticated code execution flaws, spanning Langflow releases from 1.0.0 through 1.11.4.
One of the authenticated flaws is CVE-2026-93674. The post describes the new module as detecting and exploiting an authenticated blind command injection affecting Langflow versions 1.5.0 through 1.9.0. IBM's advisory describes the same identifier as allowing a remote attacker to execute arbitrary code through improper neutralization of special elements used in an OS command, affecting Langflow OSS 1.0.0 through 1.12.2, and carries a critical CVSS 3.1 base score of 9.8.
The two descriptions differ on affected ranges, so operators should treat the vendor advisory as the reference for exposure rather than the module notes. The post credits Richard Howe as module author, with research credit to Peter Girnus and n0k0.
Why it matters: working exploit modules lower the effort needed to test these flaws, and Langflow deployments often sit close to credentials and internal tooling. Defenders should inventory Langflow instances, check versions against the vendor advisory, and restrict who can reach the interface. The post does not state a patch status for CVE-2026-93674.
CVE references
Sources
- Metasploit Wrap Up: Langflow, MongoDB, and MorePrimarywww.rapid7.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning