Six Langflow Exploits Land in Metasploit, Putting Older AI Workflow Servers in Easy Reach

Anyone running an older Langflow server should upgrade now: ready-made exploit code for six Langflow vulnerabilities is now part of Metasploit, the widely used open-source penetration-testing framework. Rapid7’s Metasploit release of October 23, 2026 adds six modules aimed at Langflow, the open-source visual builder for LLM apps and agents. Three of them run code on a server without any login, and the worst targets a flaw rated CVSS 10.0. These are not new bugs: all six were disclosed earlier this year, and fixes have shipped over the past several months. What changed on October 23 is that working exploits went public in Metasploit, so it now takes little skill to use them.

What the six modules cover

Rapid7’s release notes say the six modules span Langflow releases from 1.0.0 through 1.11.4. They were contributed by rmhowe425, with research credit to Peter Girnus and n0k0.

• CVE-2026-10134 (CVSS 10.0): unauthenticated remote code execution through public flow builds, affecting Langflow 1.0.0 through 1.9.3.
• CVE-2026-0768: unauthenticated code execution through the code-validation endpoint, targeting Langflow 1.4.2.
• CVE-2026-0769: unauthenticated code execution through custom-component evaluation, targeting Langflow 1.3.2.
• CVE-2026-7873 (CVSS 9.9): authenticated code execution through code validation, in 1.0.0 through 1.10.0.
• CVE-2026-93674: blind command injection that Rapid7 lists as authenticated, in 1.5.0 through 1.9.0.
• CVE-2026-93680: an authentication bypass in 1.5.0 through 1.11.4, shipped as an information-gathering module rather than an exploit.

The labels don’t all agree. IBM, which publishes Langflow’s security bulletins, scores CVE-2026-93674 at 9.8 with no privileges required, and its bulletin lists the affected range as 1.0.0 through 1.12.2, wider than the range in the Metasploit module. Defenders should go by the wider range.

How the worst bug works

IBM’s bulletin for CVE-2026-10134, first published on June 23, describes the problem in Langflow’s PythonCodeStructuredTool component. When a flow is built, the component passes its tool_code field to Python’s exec(), and that field can be controlled by an attacker. There are two ways in. A logged-in user can trigger a build directly. More seriously, once any legitimate user marks a flow containing the component as public, a separate public build endpoint accepts builds with no Authorization header at all, so any visitor can run code on the server.

IBM lists what an attacker gains: every secret available to the Langflow process, read and write access to every flow, conversation, message, file upload and saved component in the database, a path to internal services and cloud metadata endpoints, and the ability to move to other tenants on the same instance. An attacker can also stay in by editing the public flow’s tool_code, so that ordinary builds by any user re-run the attacker’s code. IBM names Langflow 1.10.0 as the fix and lists no workaround.

Why a Metasploit module matters

Most of these flaws have been public for months, and Langflow has been a target before: we covered its MCP stdio command-execution CVEs on October 6. GitHub’s advisory database has listed CVE-2026-0768 and CVE-2026-0769, both found through Zero Day Initiative, since January 23, and CVE-2026-10134 and CVE-2026-7873 since June 30. What a Metasploit module adds is reliability and reach. An attacker no longer needs to read an advisory and build a working exploit. They can pick a module, point it at an address and run it. Langflow servers are often deployed by teams prototyping agents, sometimes with cloud credentials and model API keys loaded into the same process, which makes a forgotten test instance a valuable target.

Which version to run

The fixes are spread across several releases. GitHub’s advisory gives 1.10.1.rc0 as the first patched version for CVE-2026-7873. IBM’s October 2 bulletin, which covers CVE-2026-93674 and more than 20 other Langflow CVEs, says all of them are fixed in 1.12.3, released on September 22. Langflow has shipped several releases since then, and the newest are 1.12.8 and 1.13.0, both published on October 22.

The simplest advice is to move to the latest release rather than the minimum fixed version. Beyond that:

• Keep Langflow off the open internet, behind authentication or a VPN.
• Review flows marked public, unset the flag where it isn’t needed, and check public flows for tool_code you didn’t write.
• After patching, rotate API keys, database credentials and any cloud credentials the Langflow process could read.

The same Metasploit release also adds an unauthenticated code-execution chain for OpenCTI, three MongoDB auxiliary modules and an exploit for a 2024 Grafana bug. For teams running AI tooling, though, the Langflow set is the part to act on this week.