This release adds multiple new modules, and 6 of those modules point at a single target: Langflow, the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680), 3 unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134), and 2 authenticated code execution flaws (CVE-2026-7873 and CVE-2026-93674), spanning Langflow releases from 1.0.0 through 1.11.4. Thanks to the work of rmhowe425, with research credit to Peter Girnus and n0k0. Beyond Langflow, open source contributor kmkz contributed a pre-auth RCE chain against OpenCTI. MongoDB coverage has also been expanded with 3 new auxiliary modules plus an Apache Solr version scanner thanks to the work of community member h00die.
New Module Content (11)4gaBoards Mass User Information Disclosure (CVE-2026-53959)
Authors: Balachandar Gowrisankar, de3erve (GitHub), and lucquach (GitHub)
Type: Auxiliary
Pull request: #21831 contributed by anirbala98
Path: gather/4gaboards_users_info_disclosure_cve_2026_53959
CVE reference: CVE-2026-53959
Description: Adds a module that exploits CVE-2026-53959, a broken access control vulnerability allowing mass user information disclosure in 4gaBoards versions 3.3.8 and below. The application's /api/users REST endpoint lets any authenticated user retrieve a full, unpaginated list of every user in the system. Missing authorization checks allow an attacker to retrieve the email, phone, organization, name, and SSO email addresses (ssoGoogleEmail, ssoGithubEmail, and others) of every user.
Langflow AI Authentication Bypass (CVE-2026-93680)
Author: Richard Howe
Type: Auxiliary
Pull request: #21942 contributed by rmhowe425
Path: gather/langflow_auth_bypass_cve_2026_93680
CVE reference: CVE-2026-93680
Description: Adds a new auxiliary module that leverages CVE-2026-93680, an authentication bypass vulnerability impacting Langflow versions 1.5.0 through 1.11.4.
Apache Solr Version Scanner
Author: h00die
Type: Auxiliary
Pull request: #22006 contributed by h00die
Path: scanner/http/apache_solr_version
Description: Adds a new scanner that identifies Apache Solr and reports its version.
MongoDB Auxiliary Module Suite
Authors: h00die and prithvee07
Type: Auxiliary
Pull request: #21785 contributed by h00die
Description: Adds the mongodb_version, mongodb_schemadump, and mongodb_hashdump auxiliary modules, and updates the existing mongodb_login module.
This PR adds the following modules:
- scanner/mongodb/mongodb_hashdump
- scanner/mongodb/mongodb_schemadump
- scanner/mongodb/mongodb_version
OpenCTI Authentication Bypass and Notifier EJS Remote Code Execution
Author: Jean-Marie Bourbon
Type: Exploit
Pull request: #21826 contributed by kmkz
Path: linux/http/opencti_notifier_rce
CVE references: CVE-2026-27960 and CVE-2026-39980
Description: Adds a new exploit module for OpenCTI that chains CVE-2026-27960 and CVE-2026-39980 to achieve unauthenticated remote command execution.
Grafana SQL Expressions DuckDB Command Injection (CVE-2024-9264)
Author: Özcan Ersan (@ozcanpng)
Type: Exploit
Pull request: #21901 contributed by ozcanpng
Path: multi/http/grafana_sql_expressions_rce_cve_2024_9264
CVE reference: CVE-2024-9264
Description: Adds an authenticated exploit module for CVE-2024-9264, a DuckDB command injection in Grafana SQL Expressions.
Langflow AI Code Validation Authenticated RCE (CVE-2026-7873)
Authors: Richard Howe and n0k0
Type: Exploit
Pull request: #21877 contributed by rmhowe425
Path: multi/http/langflow_auth_rce_cve_2026_7873
CVE reference: CVE-2026-7873
Description: Adds a new exploit module that detects and exploits CVE-2026-7873, an authenticated RCE vulnerability impacting Langflow versions 1.0.0 through 1.10.0.
Langflow AI Authenticated Command Injection (CVE-2026-93674)
Author: Richard Howe
Type: Exploit
Pull request: #21939 contributed by rmhowe425
Path: multi/http/langflow_auth_command_injection_cve_2026_93674
CVE reference: CVE-2026-93674
Description: Adds a new exploit module that detects and exploits CVE-2026-93674, an authenticated blind command injection vulnerability impacting Langflow versions 1.5.0 through 1.9.0.
Langflow AI Validate Code Injection Unauth RCE (CVE-2026-0768)
Authors: Peter Girnus and Richard Howe
Type: Exploit
Pull request: #21864 contributed by rmhowe425
Path: multi/http/langflow_unauth_rce_cve_2026_0768
CVE reference: CVE-2026-0768
Description: Adds a new exploit module that detects and exploits CVE-2026-0768, an unauthenticated remote code execution vulnerability impacting Langflow version 1.4.2.
Langflow AI Custom Component Eval Injection Unauth RCE (CVE-2026-0769)
Authors: Peter Girnus and Richard Howe
Type: Exploit
Pull request: #21867 contributed by rmhowe425
Path: multi/http/langflow_unauth_rce_cve_2026_0769
CVE reference: CVE-2026-0769
Description: Adds a new exploit module that detects and exploits CVE-2026-0769, an unauthenticated RCE vulnerability impacting Langflow version 1.3.2.
Langflow AI Public Flow Build Unauth RCE (CVE-2026-10134)
Author: Richard Howe
Type: Exploit
Pull request: #21875 contributed
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: