CVE-2026-93680

This is a solid Metasploit release cycle. The Langflow coverage is the headline here—six modules targeting a single LLM workflow builder is unusual and signals that tooling is becoming a prime attack surface.

Technical Breakdown

Langflow (CVE-2026-93680, CVE-2026-0768, CVE-2026-0769, CVE-2026-10134, CVE-2026-7873, CVE-2026-93674): Covers versions 1.0.0 through 1.11.4. Includes an auth bypass, three unauthenticated RCE paths, and two authenticated code execution flaws. If you're running Langflow in any capacity, this is a priority patch cycle. OpenCTI (Pre-auth RCE): Contributed by kmkz. No CVE listed in the summary, but a pre-auth chain against a threat intel platform is a high-severity finding. Treat as critical until patched. MongoDB: Three new auxiliary modules added by h00die. Likely for enumeration and recon, not exploitation. Apache Solr: Version scanner added. Useful for pre-attack reconnaissance. 4gaBoards (CVE-2026-53959): Mass user information disclosure via auxiliary module. Low severity but useful for lateral movement recon.

Defense

Langflow: Immediately isolate or patch any Langflow instances. The breadth of CVEs (auth bypass + multiple RCEs) means a single unpatched box is a guaranteed foothold. OpenCTI: Check for the pre-auth RCE module in your Metasploit instance and test against staging. If it works, assume production is vulnerable. General: Update your Metasploit framework to get these modules. Run the new scanners (MongoDB, Solr, 4gaBoards) against your own environment to identify exposed services before an attacker does.

Source: https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-langflow-mongodb-and-more