Rapid7 added six Langflow modules to Metasploit, including CVSS 10.0 CVE-2026-10134. Upgrade to 1.12.3 or later and take Langflow off the open internet.
Rapid7's Metasploit wrap-up of 23 October 2026 adds six Langflow modules, so ready-made exploitation code now exists for a family of bugs that have been public for months. Three are unauthenticated remote code execution (RCE) exploits, and Rapid7 labels two more as authenticated, although IBM and NVD score one of those, CVE-2026-93674, as needing no login. The headline module targets CVE-2026-10134, scored CVSS 10.0, in Langflow 1.0.0 through 1.9.3. Anyone running Langflow below 1.12.3 should upgrade now, and the newest GitHub release is 1.13.0.
What the modules cover
Rapid7 says the set spans Langflow releases from 1.0.0 through 1.11.4. The version ranges below are Rapid7's for the modules, set beside the fixes in IBM's bulletins.
| CVE | Module type | Auth | CVSS | Fixed in |
|---|---|---|---|---|
| CVE-2026-10134 | Exploit, public flow build | None | 10.0 (3.1) | 1.10.0 (IBM) |
| CVE-2026-0768 | Exploit, validate endpoint code injection | None | 9.8 (3.0) | Not documented |
| CVE-2026-0769 | Exploit, custom component eval injection | None | 9.8 (3.0) | Not documented |
| CVE-2026-7873 | Exploit, code validation | Required | 9.9 (3.1) | 1.10.1 (IBM) |
| CVE-2026-93674 | Exploit, blind command injection | See below | 9.8 (3.1) | 1.12.3 (IBM) |
All five verified CVEs score 9.8 to 10.0. A sixth module, an auxiliary authentication bypass for CVE-2026-93680 said to affect 1.5.0 through 1.11.4, could not be checked. NVD returned no record for that ID on 24 October, so treat it as unverified.
CVE-2026-10134: public flows build without a login
IBM's bulletin describes unauthenticated server-side RCE through the PythonCodeStructuredTool. When a flow is marked public, builds need no authentication, and attacker-controlled template content is then executed on the server. The scope is changed (CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). IBM lists the consequences as reading every secret available to the Langflow process, reading and modifying flows and stored data, reaching internal services and cloud metadata endpoints, and moving to other tenants on the same instance. An attacker can also persist by editing the public flow's tool_code, so ordinary /api/v1/build/... calls by any user re-run the attacker's code. IBM names 1.10.0 as the fix and lists no workaround. NVD's range ends at 1.9.3, which matches.
The two Zero Day Initiative bugs
CVE-2026-0768 and CVE-2026-0769 were published by Trend's Zero Day Initiative on 9 January 2026 as ZDI-26-034 and ZDI-26-035, after ZDI had reported them on 18 July 2025 and then announced a zero-day release. In 0768 the code parameter of the validate endpoint is run as Python, and ZDI says the code executes as root. In 0769 eval_custom_component_code evaluates a user-supplied string. NVD lists only 1.4.2 and 1.3.2 respectively. None of NVD, ZDI or OSV records a fixed version, and the langflow-ai/langflow security advisories we checked had no matching entry. The only mitigation ZDI offers is to restrict interaction with the product. The fixed release is unconfirmed, so do not assume a particular version closes them.
CVE-2026-7873 and CVE-2026-93674
CVE-2026-7873 lets an authenticated user run OS commands and read files such as credentials. IBM credits Nikolas Null (n0k0) of mnemonic and fixes it in 1.10.1, where validation compiles code without executing it.
For CVE-2026-93674 the sources disagree. Rapid7 labels its module authenticated, for 1.5.0 through 1.9.0. IBM's 2 October bulletin and NVD score it 9.8 with no privileges required and list 1.0.0 up to 1.12.2 as affected. This is one of two unauthenticated flaws in the 25-CVE batch we covered in Langflow 1.12.3 Fixes 25 Flaws. Plan on the broader IBM range until the discrepancy is explained.
Which Langflow versions each exploit reaches; two have no documented fix.
What Langflow owners should do
- Upgrade to the latest release, not just the minimum. 1.12.3 (22 September) covers CVE-2026-10134, CVE-2026-7873 and CVE-2026-93674, and 1.13.0 was released on 22 October. IBM lists no workarounds for any of these.
- Remove Langflow from the open internet and put it behind authentication or a VPN. Because the ZDI pair has no documented fix, this is the only control for them.
- Review flows marked public and unset the flag where it is not needed; check their
tool_codefor edits you did not make. - After patching, rotate API keys and database credentials the instance could read. Look for unexpected requests to validate and build endpoints.
None of the six CVEs was in CISA's Known Exploited Vulnerabilities catalogue in the feed released 23 October. Langflow flaws are, though: CVE-2026-9198, CVE-2026-0770, CVE-2026-55255, CVE-2025-34291, CVE-2026-33017 and CVE-2025-3248 are all listed. A public Metasploit module usually shortens the time between disclosure and scanning.