cyber.hendryadrian.com
Vulnerability & Exploit · rapid7.com

Metasploit Adds Exploit Modules for Langflow, OpenCTI, Grafana and More

· Original article ↗

Summary

Metasploit adds 11 modules, including six covering Langflow authentication-bypass and code-execution flaws, an unauthenticated OpenCTI RCE chain, and modules for 4gaBoards, Grafana, MongoDB and Apache Solr.

Key points

  • Six new modules cover Langflow vulnerabilities: one authentication bypass and five code-execution paths, with affected releases spanning versions 1.0.0 through 1.11.4.
  • An OpenCTI exploit module chains CVE-2026-27960 and CVE-2026-39980 for unauthenticated remote command execution.
  • A 4gaBoards module targets CVE-2026-53959, which can expose user information to authenticated users in versions 3.3.8 and below.
  • A Grafana module targets authenticated DuckDB command injection via CVE-2024-9264.
  • The update adds MongoDB version, schema-dump and hash-dump auxiliary modules, plus an Apache Solr version scanner.

Article Details

Vulnerability Types
  • Broken access control
  • Authentication bypass
  • Unauthenticated remote code execution
  • Authenticated remote code execution
  • Command injection
  • Information disclosure
Affected Versions
  • 4gaBoards: 3.3.8 and below
  • Langflow: 1.5.0 through 1.11.4
  • Langflow: 1.0.0 through 1.10.0
  • Langflow: 1.5.0 through 1.9.0
  • Langflow: 1.4.2
  • Langflow: 1.3.2
  • Langflow: 1.0.0 through 1.9.3
Exploitation Status
unknown
Exploit Availability
public_exploit
Patch Status
unknown

CVE

CVE-2024-9264Grafana SQL Expressions DuckDB Command Injection (CVE-2024-9264)CVE-2026-0768they cover an authentication bypass (CVE-2026-93680), 3 unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134), and 2 authenticated code execution flaws (CVE-2026-7873 andCVE-2026-0769authentication bypass (CVE-2026-93680), 3 unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134), and 2 authenticated code execution flaws (CVE-2026-7873 and CVE-2026-93674),CVE-2026-10134(CVE-2026-93680), 3 unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134), and 2 authenticated code execution flaws (CVE-2026-7873 and CVE-2026-93674), spanning LangflowCVE-2026-27960CVE references: CVE-2026-27960 and CVE-2026-39980CVE-2026-39980CVE references: CVE-2026-27960 and CVE-2026-39980CVE-2026-539594gaBoards Mass User Information Disclosure (CVE-2026-53959)CVE-2026-7873paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134), and 2 authenticated code execution flaws (CVE-2026-7873 and CVE-2026-93674), spanning Langflow releases from 1.0.0 through 1.11.4. Thanks to the work ofCVE-2026-93674CVE-2026-0769, and CVE-2026-10134), and 2 authenticated code execution flaws (CVE-2026-7873 and CVE-2026-93674), spanning Langflow releases from 1.0.0 through 1.11.4. Thanks to the work of rmhowe425, withCVE-2026-93680target: Langflow, the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680), 3 unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134),

People

Balachandar GowisankarCoauthored the Metasploit module for the 4gaBoards mass user information disclosure vulnerability.de3erveCoauthored the Metasploit module for the 4gaBoards mass user information disclosure vulnerability.h00dieContributed the Apache Solr version scanner and coauthored the MongoDB auxiliary module suite.Jean-Marie BourbonAuthored the Metasploit exploit module chaining two OpenCTI vulnerabilities for unauthenticated remote command execution.kmkzContributed the OpenCTI pre-authentication RCE chain.lucquachCoauthored the Metasploit module for the 4gaBoards mass user information disclosure vulnerability.n0k0Coauthored a Langflow authenticated RCE module and received research credit for the Langflow work.Özcan ErsanAuthored the Metasploit exploit module for the authenticated Grafana SQL Expressions DuckDB command injection.Peter GirnusCoauthored Langflow unauthenticated RCE modules and received research credit for the Langflow work.prithvee07Coauthored the MongoDB auxiliary module suite.Richard HoweAuthored multiple Langflow authentication-bypass and code-execution modules in the Metasploit release.

Products

4gaBoards4gaBoards Mass User Information Disclosure (CVE-2026-53959)Apache Solrchain against OpenCTI. MongoDB coverage has also been expanded with 3 new auxiliary modules plus an Apache Solr version scanner thanks to the work of community member h00die.GrafanaGrafana SQL Expressions DuckDB Command Injection (CVE-2024-9264)LangflowThis release adds multiple new modules, and 6 of those modules point at a single target: Langflow, the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680), 3 unauthenticatedMongoDBn0k0. Beyond Langflow, open source contributor kmkz contributed a pre-auth RCE chain against OpenCTI. MongoDB coverage has also been expanded with 3 new auxiliary modules plus an Apache Solr version scanner thanksOpenCTIGirnus and n0k0. Beyond Langflow, open source contributor kmkz contributed a pre-auth RCE chain against OpenCTI. MongoDB coverage has also been expanded with 3 new auxiliary modules plus an Apache Solr version scanner

Tools

Metasploit FrameworkAs always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:

Related Articles