Langflow flaws get six Metasploit exploit modules
Rapid7 has shipped six new Metasploit modules targeting Langflow, the open-source tool for building applications with large language models. Together they cover an authentication bypass, three unauthenticated remote code execution paths and two authenticated code execution flaws, spanning Langflow releases from 1.0.0 through 1.11.4. The release matters because Langflow deployments often hold API keys and credentials for other services, so code execution in Langflow can quickly become access to much more.
The modules, contributed with research credit to Peter Girnus and others, are: an authentication bypass tracked as CVE-2026-93680, affecting Langflow 1.5.0 through 1.11.4; three unauthenticated remote code execution paths tracked as CVE-2026-0768, CVE-2026-0769 and CVE-2026-10134; and two authenticated code execution flaws tracked as CVE-2026-7873 and CVE-2026-93674. CVE-2026-93674, a code injection flaw in IBM Langflow OSS, is rated CVSS 9.8, critical, and is listed as fixed in Langflow 1.12.3.
Why AI workflow tools are high-value targets
Low-code AI builders are designed so non-specialists can add integrations quickly, and they are often set up outside normal change control on cloud servers holding real keys. A setting that names a command, a module path or a URL to load should be treated as code execution, not as harmless configuration. The Metasploit release lowers the barrier further: once tested modules are public, scanning for exposed Langflow instances and trying known flaws becomes routine work for attackers.
What Langflow operators should do
Operators should upgrade to a patched release, confirm the running version afterwards, and check vendor advisories for each CVE rather than assuming one upgrade covers every flaw. Langflow should not be exposed directly to the internet without authentication, and any instance that was reachable while vulnerable should be checked for unexpected flows, credentials use and outbound connections. Restricting network access and monitoring for command execution remain essential until patching is confirmed.
