Metasploit adds RCE exploits for Langflow and OpenCTI targeting AI and threat intel platforms

1. Executive summary

Rapid7's Metasploit Framework release of 2026-10-23 adds eleven modules, six of which target Langflow, the open-source LLM workflow builder. The Langflow set covers an authentication bypass (CVE-2026-93680), three unauthenticated RCE paths (CVE-2026-0768, CVE-2026-0769, CVE-2026-10134) and two authenticated code execution flaws (CVE-2026-7873, CVE-2026-93674), spanning Langflow releases 1.0.0 through 1.11.4. The same release adds a pre-authentication RCE chain against OpenCTI (CVE-2026-27960, CVSS 9.8, chained with CVE-2026-39980, CVSS 9.1) and an authenticated Grafana DuckDB command injection module for CVE-2024-9264, which carries an EPSS of 97%. None of the CVEs in this release is in CISA KEV. The exposure for EMEA financial services is concentrated in internal AI tooling and threat-intelligence platforms that are frequently deployed with weak or absent authentication and reachable from corporate networks; weaponised, point-and-click exploit code now exists for all of them.

2. Regulatory framing

3. Technical analysis & attack chain

The release is a tooling event, not an observed campaign. Rapid7 published working Metasploit modules for the CVEs below; the modules detect and exploit the flaws. No source in this item reports exploitation in the wild of these specific CVEs, and none is in CISA KEV. The attack chain below is the exploitation path the modules implement, as described by Rapid7.

1. An attacker identifies an exposed Langflow instance. The modules cover releases 1.0.0 through 1.11.4, so version fingerprinting determines which path applies.
2. For unauthenticated access, the attacker uses CVE-2026-0768 (Langflow 1.4.2), CVE-2026-0769 (Langflow 1.3.2) or CVE-2026-10134 (Langflow 1.0.0 through 1.9.3). Each is an unauthenticated RCE path with a dedicated module (multi/http/langflow_unauth_rce_cve_2026_0768, ..._0769, ..._10134).
3. Where authentication is required, the attacker first uses the CVE-2026-93680 authentication bypass module (gather/langflow_auth_bypass_cve_2026_93680), which affects Langflow 1.5.0 through 1.11.4, then runs the authenticated RCE modules: CVE-2026-7873 (multi/http/langflow_auth_rce_cve_2026_7873, Langflow 1.0.0 through 1.10.0) or CVE-2026-93674 (multi/http/langflow_auth_command_injection_cve_2026_93674, a blind command injection in Langflow 1.5.0 through 1.9.0).
4. For OpenCTI, the attacker chains CVE-2026-27960 (improper authentication, CVSS 9.8) with CVE-2026-39980 (CVSS 9.1) through the linux/http/opencti_notifier_rce module to reach unauthenticated remote command execution. The module name points at the notifier component; the source does not describe the individual mechanism of either CVE beyond the chain outcome.
5. For Grafana, an authenticated attacker with a session uses CVE-2024-9264, a DuckDB command injection in Grafana SQL Expressions, through multi/http/grafana_sql_expressions_rce_cve_2024_9264. This CVE has an EPSS of 97%, the highest in the set, and is the one most likely to be attempted against any exposed Grafana instance.

The remaining modules in the release are lower priority for financial services but relevant to asset discovery. CVE-2026-53959 (CVSS 6.5) is a broken access control flaw in 4gaBoards 3.3.8 and below: the /api/users REST endpoint returns a full, unpaginated list of every user to any authenticated user, exposing email, phone, organisation, name and SSO email addresses (ssoGoogleEmail, ssoGithubEmail and others). The release also adds MongoDB auxiliary modules (mongodb_version, mongodb_schemadump, mongodb_hashdump, plus an update to mongodb_login) and an Apache Solr version scanner (scanner/http/apache_solr_version). These are reconnaissance and credential-dump aids; they do not by themselves indicate a new vulnerability.

Two discrepancies need flagging. The source lists CVE-2026-93680 (the Langflow authentication bypass) but no CVSS score, severity or EPSS value is available for it in the verified data, so it is treated here as an unrated flaw that still matters because it unlocks the authenticated RCE modules. Separately, the related reporting on Langflow exploitation in the wild concerns different CVEs (CVE-2026-105740, CVE-2026-33017 and the KEV-listed CVE-2026-0770), not the CVEs in this release; those reports should not be read as evidence that the modules in this release have been used in attacks.

Attribution: none. No actor is named in the source, and no MITRE ATT&CK profile applies. The modules are community and Rapid7 contributions (rmhowe425, kmkz, h00die, ozcanpng and others); contributor handles are not threat actors.

4. Mitigation & containment

P1 (within 24 hours)

• Inventory every Langflow deployment and record its version. Any instance at 1.11.4 or below is in scope for at least one module in this release. Instances at 1.4.2, 1.3.2 and 1.0.0 through 1.9.3 are exposed to unauthenticated RCE and should be treated as internet-facing until proven otherwise.
• Inventory OpenCTI and Grafana. For OpenCTI, confirm the version against the vendor fix for CVE-2026-27960 and CVE-2026-39980. For Grafana, confirm the version against the fix for CVE-2024-9264 and restrict the SQL Expressions feature to trusted users.
• Block inbound access to Langflow, OpenCTI and Grafana management interfaces from anything other than named administrative networks. These platforms are commonly deployed on internal networks with no authentication in front of them.
• Search proxy and EDR telemetry for requests to the Langflow, OpenCTI and Grafana endpoints the modules use. The source names the module paths but not the HTTP request paths; use the module source in the Metasploit repository (multi/http/langflow_*, linux/http/opencti_notifier_rce, multi/http/grafana_sql_expressions_rce_cve_2024_9264) to derive the exact request signatures for your environment.

P2 (within 72 hours)

• Patch or upgrade Langflow to a release above 1.11.4 where the vendor fix is available, and pin the version in container images and build pipelines so redeployment does not reintroduce an affected release.
• Patch OpenCTI for CVE-2026-27960 and CVE-2026-39980, and Grafana for CVE-2024-9264.
• For 4gaBoards 3.3.8 and below, upgrade and review the /api/users endpoint for evidence of bulk enumeration. Any authenticated user could have pulled the full user list, including SSO email addresses.
• Restrict MongoDB and Apache Solr to trusted networks and require authentication. The new auxiliary modules make version fingerprinting and hash dumping trivial against exposed instances.

P3 (within 7 days)

• Run the Metasploit modules against non-production instances of Langflow, OpenCTI and Grafana to confirm the fixes hold. This is the DORA Art. 24 testing use of the release.
• Add the platforms to the third-party register with their current version and fix status (DORA Art. 28, NIS2 Art. 21(2)(d)).

5. Indicators of compromise

No indicators of compromise available in the source material. The source describes module paths and CVE identifiers, not atomic artefacts from an attack. The module paths are tooling references, not indicators, and are not reproduced as IOCs.

6. Detection

The source gives module paths and CVE identifiers but no distinctive strings, command lines, file names or network artefacts from the exploits themselves. A YARA rule built on CVE identifiers or module names would detect reporting about the tooling, not the tooling in use, so none is emitted.

Detection should focus on behaviour. The Sigma rule below flags execution of the Metasploit console and the msfupdate command named in the source, which is a generic signal that exploit tooling is present on a host; it does not detect the Langflow, OpenCTI or Grafana exploits specifically.

title: Metasploit Framework Console or Update Execution
id: 8f3c2a91-4d7e-4b1a-9c2e-6a5d0f1b7e34
status: experimental
description: Detects execution of msfconsole or msfupdate, indicating Metasploit Framework is installed or being updated on a host. Generic tooling signal, not specific to the Langflow, OpenCTI or Grafana modules in this release.
author: Adverse Trace
date: 2026-10-23
references:

  - https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-langflow-mongodb-and-more
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:

      - '/msfconsole'
      - '/msfupdate'
  condition: selection
falsepositives:

  - Authorised penetration testing or red team activity
  - Security teams running Metasploit for validation
level: medium

For the platform side, alert on unauthenticated requests to Langflow API endpoints from unfamiliar sources, on OpenCTI notifier configuration changes, and on Grafana SQL Expressions queries that invoke DuckDB functions. The source does not give the exact request paths, so these rules must be built from the module source in the Metasploit repository.

CVE assessment

9 referenced CVEs — 8 critical (CVSS ≥ 9.0)

Could not resolve: CVE-2026-93680.

7. Sources

• Rapid7, "Metasploit Wrap Up: Langflow, MongoDB, and More", 2026-10-23. https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-langflow-mongodb-and-more
• Rapid7, "Metasploit Wrap Up: This One Goes to Sixteen!", related context on Metasploit module cadence. https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-goes-to-sixteen
• Rapid7, "Metasploit Wrap Up: Lot of summer shells and fit http profiles", related context. https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-lot-of-summer-shells-and-fit-http-profiles
• Rapid7, "Weekly Metasploit Update: NTLM Relay Priv Esc, MCP Server Integration, Paperclip AI RCE Chain, and more", related context. https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-19-06-2026
• The Hacker News, "Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts", related context on a different Langflow CVE (CVE-2026-105740). https://thehackernews.com/2026/10/langflows-critical-authenticated-rce.html
• The Hacker News, "Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints", related context on a different Langflow CVE (CVE-2026-33017). https://thehackernews.com/2026/06/langflow-rce-exploited-to-deploy-monero.html
• NVD, CVE-2026-0770 (CISA KEV entry, Langflow), related context on a different Langflow CVE. https://nvd.nist.gov/vuln/detail/CVE-2026-0770

8. Adverse Trace position

Adverse Trace assesses this as a tooling-driven exposure event rather than an active campaign. The highest-severity items are CVE-2026-10134 (CVSS 10.0), CVE-2026-7873 (CVSS 9.9) and CVE-2026-0768, CVE-2026-0769, CVE-2026-27960 and CVE-2026-93674 (all CVSS 9.8), none of which is in CISA KEV; the highest EPSS in the set is CVE-2024-9264 at 97%, followed by CVE-2026-0769 at 41% and CVE-2026-0768 at 23%. The practical risk is that Langflow, OpenCTI and Grafana are often deployed by AI and threat-intel teams outside the standard patching cycle, with weak authentication and broad network reach. The attribution is unconfirmed: no actor is named and no MITRE ATT&CK profile applies. The Langflow exploitation reporting in the related sources concerns different CVEs and should not be read across. We will track vendor fixes for CVE-2026-93680, CVE-2026-27960 and CVE-2026-39980, where the source gives no fix version, and will update this advisory when those versions are published. Clients should confirm their Langflow, OpenCTI and Grafana versions to Adverse Trace so we can prioritise the P1 inventory against their estate.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.