This release adds multiple new modules, and 6 of those modules point at a single target: Langflow, the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680), 3 unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134), and 2 authenticated code execution flaws (CVE-2026-7873 and CVE-2026-93674), spanning Langflow releases from 1.0.0 through 1.11.4.
Metasploit Wrap Up: Langflow, MongoDB, and More
About this summary. This is a short excerpt from the description that Rapid7 published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-langflow-mongodb-and-more
Source attribution: headline and facts are from Rapid7 (rapid7.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
LiteLLM Hijacked Again: Malicious 1.107.0 Wheels Steal Credentials and Load Remote Code
The JFrog Security Research team identified malicious code in `litellm` 1.107.0, a widely used Python interface and proxy for large language model providers. The payload…
New LiteLLM Supply Chain Attack Hits PyPI and Docker
A new LiteLLM supply chain attack has turned version 1.107.0, an official release of the popular open-source LLM gateway, into a credential stealer. On October 21, 2026…
Unbounded Losses, Unchecked Inputs: Measuring the Safeguards of LLM Options-Trading Agents
arXiv:2610.24289v1 Announce Type: new Abstract: Large language model (LLM) agents now place options orders at retail brokers, and developers publish open-source options…
How we found 24 Android vulnerabilities using our open source AI security agent
With the rise of AI in the security space, our team created the GitHub Security Lab Taskflow Agent as a way for security researchers to easily automate, package, and…
Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol
arXiv:2610.36108v1 Announce Type: new Abstract: LLM agents increasingly access external tools through the Model Context Protocol (MCP), but the natural-language metadata…
SpecGuard: Detecting Multi-Turn LLM Jailbreaks via Specification-Based Runtime Monitoring
arXiv:2610.36258v1 Announce Type: new Abstract: Multi-turn jailbreaks turn dialogue safety into a trace property: a violation may become identifiable only when user…