Metasploit Adds Modules for GitLab File Read, Langflow RCE and IPv6 DNS Takeover
Summary
The Metasploit 6.5.5 roundup adds modules for an actively exploited unauthenticated GitLab file-read flaw, authenticated Langflow RCE, IPv6 DNS takeover, and Kate persistence, alongside other framework updates.
Key points
- A new module targets CVE-2026-85706, an unauthenticated file-read flaw in GitLab CE and EE; the article says it is exploited in the wild.
- Affected GitLab versions are 18.7 to before 19.1.8, 19.2 to before 19.2.6, and 19.3 to before 19.3.2.
- New DHCPv6 and IPv6 router-advertisement modules can coerce Windows and RFC 8106 clients into using an attacker-controlled DNS server, supporting a Kerberos relay attack chain.
- A new exploit module targets authenticated RCE CVE-2026-18729 in Langflow versions 1.11.1 and below.
- The roundup also adds a multiplatform persistence module for Kate and updates ZoomEye search handling.
- The article says users can update the Metasploit Framework to version 6.5.5 with msfupdate.
Article Details
- Event Type
- Metasploit Framework wrap-up announcing new exploit and auxiliary modules, module enhancements, and bug fixes.
- Impact
- The new modules address an unauthenticated arbitrary file-read vulnerability in GitLab, authenticated remote code execution in Langflow, and IPv6 DNS takeover techniques affecting Windows and RFC 8106 clients. The article advises users of affected self-hosted GitLab versions to patch. It does not report confirmed exploitation of the Langflow or DNS-takeover vulnerabilities.
CVE
People
guneykabelNamed author of the GitLab unauthenticated arbitrary file-read module.jburgess-r7Metasploit team member who gave a talk about 0day research.jheysel-r7Named author of the GitLab unauthenticated arbitrary file-read module and contributor to its pull request.Pushpender RathoreNamed author of the DHCPv6 DNS takeover modules.Richard HoweNamed author of the Langflow authenticated RCE module; the article also gives the identifier rhowe425.s3ntagoNamed author of the GitLab unauthenticated arbitrary file-read module.
Products
GitLabGitLab. Unauthenticated.KateKate Plugin PersistenceLangflowAnd finally, Langflow brings us authenticated RCE via custom components, continuing the proud AI-industry tradition of building a feature that lets users run arbitrary Python and then being shocked when users runMicrosoft WindowsNext, for anyone who has ever wanted to become the DNS server for an entire Windows network without the hassle of asking permission, we now have native mitm6-style DHCPv6 and IPv6 RA DNS takeover modules.RFC 8106Operating as a rogue IPv6 router and a rogue DHCPv6 server respectively, these modules trick modern Windows and RFC 8106 clients into adopting the attacker as their recursive DNS server.ZoomEye#21770 from e2002e - This updates the ZoomEye search module to prevent infinite loops and list truncation when encountering empty result pages.
Tools
Metasploit FrameworkAs always, you can update to the latest Metasploit Framework with msfupdatemitm6Next, for anyone who has ever wanted to become the DNS server for an entire Windows network without the hassle of asking permission, we now have native mitm6-style DHCPv6 and IPv6 RA DNS takeover modules.