Metasploit Wrap Up: Langflow, MongoDB, and More
Rapid7, Friday, October 23rd, 2026
Rapid7's Metasploit release adds six Langflow modules plus a pre-auth RCE chain and other new modules.
Rapid7 says this Metasploit release adds multiple new modules, six of them targeting Langflow, the open-source LLM workflow builder.
They cover an authentication bypass, three unauthenticated remote code execution paths and two authenticated code execution flaws across Langflow 1.0.0 through 1.11.4.
Contributor kmkz also added a pre-auth RCE chain, alongside other modules including one involving MongoDB.
The wrap-up credits community contributors and researchers for the additions.