This release adds multiple new modules, and 6 of those modules point at a single target: Langflow, the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680), 3 unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134), and 2 authenticated code execution flaws (CVE-2026-7873 and CVE-2026-93674), spanning Langflow releases from 1.0.0 through 1.11.4. Thanks to the work of rmhowe425, with research credit to Peter Girnus and n0k0. Beyond Langflow, open source contributor kmkz contributed a pre-auth RCE chain against OpenCTI. MongoDB coverage has also been expanded with 3 new auxiliary modules plus an Apache Solr version scanner thanks to the work of community member h00die.
New Module Content (11)
4gaBoards Mass User Information Disclosure (CVE-2026-53959)
Authors: Balachandar Gowrisankar, de3erve (GitHub), and lucquach (GitHub)
Type: Auxiliary
Pull request: #21831 contributed by anirbala98
Path: gather/4gaboards_users_info_disclosure_cve_2026_53959
CVE reference: CVE-2026-53959
Description: Adds a module that exploits CVE-2026-53959, a broken access control vulnerability allowing mass user information disclosure in 4gaBoards versions 3.3.8 and below. The application's /api/users REST endpoint lets any authenticated user retrieve a full, unpaginated list of every user in the system. Missing authorization checks allow an attacker to retrieve the email, phone, organization, name, and SSO email addresses (ssoGoogleEmail, ssoGithubEmail, and others) of every user.
Langflow AI Authentication Bypass (CVE-2026-93680)
Author: Richard Howe
Type: Auxiliary
Pull request: #21942 contributed by rmhowe425
Path: gather/langflow_auth_bypass_cve_2026_93680
CVE reference: CVE-2026-93680
Description: Adds a new auxiliary module that leverages CVE-2026-93680, an authentication bypass vulnerability impacting Langflow versions 1.5.0 through 1.11.4.
Apache Solr Version Scanner
Author: h00die
Type: Auxiliary
Pull request: #22006 contributed by h00die
Path: scanner/http/apache_solr_version
Description: Adds a new scanner that identifies Apache Solr and reports its version.
MongoDB Auxiliary Module Suite
Authors: h00die and prithvee07
Type: Auxiliary
Pull request: #21785 contributed by h00die
Description: Adds the mongodb_version, mongodb_schemadump, and mongodb_hashdump auxiliary modules, and updates the existing mongodb_login module.
This PR adds the following modules:
- scanner/mongodb/mongodb_hashdump
- scanner/mongodb/mongodb_schemadump
- scanner/mongodb/mongodb_version
OpenCTI Authentication Bypass and Notifier EJS Remote Code Execution
Author: Jean-Marie Bourbon
Type: Exploit
Pull request: #21826 contributed by kmkz
Path: linux/http/opencti_notifier_rce
CVE references: CVE-2026-27960 and CVE-2026-39980
Description: Adds a new exploit module for OpenCTI that chains CVE-2026-27960 and CVE-2026-39980 to achieve unauthenticated remote command execution.
Grafana SQL Expressions DuckDB Command Injection (CVE-2024-9264)
Author: Özcan Ersan (@ozcanpng)
Type: Exploit
Pull request: #21901 contributed by ozcanpng
Path: multi/http/grafana_sql_expressions_rce_cve_2024_9264
CVE reference: CVE-2024-9264
Description: Adds an authenticated exploit module for CVE-2024-9264, a DuckDB command injection in Grafana SQL Expressions.
Langflow AI Code Validation Authenticated RCE (CVE-2026-7873)
Authors: Richard Howe and n0k0
Type: Exploit
Pull request: #21877 contributed by rmhowe425
Path: multi/http/langflow_auth_rce_cve_2026_7873
CVE reference: CVE-2026-7873
Description: Adds a new exploit module that detects and exploits CVE-2026-7873, an authenticated RCE vulnerability impacting Langflow versions 1.0.0 through 1.10.0.
Langflow AI Authenticated Command Injection (CVE-2026-93674)
Author: Richard Howe
Type: Exploit
Pull request: #21939 contributed by rmhowe425
Path: multi/http/langflow_auth_command_injection_cve_2026_93674
CVE reference: CVE-2026-93674
Description: Adds a new exploit module that detects and exploits CVE-2026-93674, an authenticated blind command injection vulnerability impacting Langflow versions 1.5.0 through 1.9.0.
Langflow AI Validate Code Injection Unauth RCE (CVE-2026-0768)
Authors: Peter Girnus and Richard Howe
Type: Exploit
Pull request: #21864 contributed by rmhowe425
Path: multi/http/langflow_unauth_rce_cve_2026_0768
CVE reference: CVE-2026-0768
Description: Adds a new exploit module that detects and exploits CVE-2026-0768, an unauthenticated remote code execution vulnerability impacting Langflow version 1.4.2.
Langflow AI Custom Component Eval Injection Unauth RCE (CVE-2026-0769)
Authors: Peter Girnus and Richard Howe
Type: Exploit
Pull request: #21867 contributed by rmhowe425
Path: multi/http/langflow_unauth_rce_cve_2026_0769
CVE reference: CVE-2026-0769
Description: Adds a new exploit module that detects and exploits CVE-2026-0769, an unauthenticated RCE vulnerability impacting Langflow version 1.3.2.
Langflow AI Public Flow Build Unauth RCE (CVE-2026-10134)
Author: Richard Howe
Type: Exploit
Pull request: #21875 contributed by rmhowe425
Path: multi/http/langflow_unauth_rce_cve_2026_10134
CVE reference: CVE-2026-10134
Description: Adds a new exploit module that detects and exploits CVE-2026-10134, an unauthenticated remote code execution vulnerability impacting Langflow versions 1.0.0 through 1.9.3.
Enhancements and Features (3)
- #20944 from Nayeraneru - Adds specs to ensure the mkdir post API behaves consistently.
- #21915 from vjonline - Consolidates reverse handler bind address handling into a shared Msf::Handler::Reverse::Bind module.
- #22041 from adfoster-r7 - Adds multiple Meterpreter improvements. The Windows Meterpreter has a major reflective-loader/IAT-import reduction, as well as improved WinAPI/error handling, and MinGW/CMake build refinements. The Python Meterpreter has improvements to Windows stat support and FreeBSD process listing. The PHP Meterpreter resolves PHP UDP channel read bugs. All Meterpreters now align on recursive mkdir -p capabilities.
Bugs Fixed (6)
- #21490 from h00die - Fixes a crash when fingerprinting HTTP services that contained null bytes.
- #21979 from adfoster-r7 - Adds additional HTTP redirect checks to multiple modules.
- #21994 from adfoster-r7 - Adds additional FTP PASV IP validation checks to multiple modules.
- #22001 from Suryanshuv14 - Fixes DirtyClone module metadata and a typo.
- #22002 from mjatin2007 - Fixes leaking TCP sockets and file descriptors when the MSSQL Login Scanner module or the MSSQL session type is used.
- #22014 from cgranleese-r7 - Fixes false positives in the detection logic of the auxiliary/gather/hikvision_info_disclosure_cve_2017_7921, auxiliary/gather/magento_xxe_cve_2024_34102, and auxiliary/scanner/http/elasticsearch_traversal modules.
Documentation
You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.
Get it
As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:
If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers or the commercial edition Metasploit Pro
