ENH: Exploit module for Langflow Unauthenticated Remote Code Execution vulnerability CVE-2026-10134

[rmhowe425]

Description

This pull request adds a new exploit module that detects and exploits an unauthenticated remote code execution vulnerability impacting Langflow versions 1.0.0 through 1.9.3

Please note the following (included in exploit .md file):

1. An unauthenticated attacker can only trigger builds using a known flow ID.
2. A low-privileged authenticated attacker can create malicious flows using credentials
   and then execute them with or without authentication.
3. Per official CVE documentation, this CVE is classified as an unauth RCE vuln

Related Issue:
Fixes #21874

Breaking Changes

None

Reviewer Notes

Verification Steps

1. docker pull and docker run langflow, per documentation
2. Start msfconsole
3. Do: use exploit/multi/http/langflow_unauth_rce_cve_2026_10134
4. Do: set rhosts=<rhost> username=<username> password=<password>
5. Do: exploit
6. You should get a meterpreter session

Test Evidence

Environment

Field	Details
Operating System	Ubuntu 22.04
Target Software/Hardware	langflow 1.8.4
Docker Image / Vagrant Setup	langflowai/langflow:1.8.4

AI Usage Disclosure

None

Pre-Submission Checklist

• Included a corresponding documentation markdown file in documentation/modules (new modules only)
• No sensitive information (IP addresses, credentials, API keys, hashes) in code or documentation
• Tested on the target environment specified in the Environment section above
• Included RSpec tests for library changes (encouraged for lib/ changes)
• Read the CONTRIBUTING.md and module acceptance guidelines