Metasploit Releases 6 Langflow Exploit Modules (CVE-2026-0768, CVE-2026-0769, CVE-2026-10134): Detection and Remediation Guide

---
title: Langflow Server Process Spawning Shell or System Utility
description: Detects the Langflow/Uvicorn Python process spawning command interpreters or download utilities, consistent with post-exploitation activity from CVE-2026-0768, CVE-2026-0769, CVE-2026-10134, CVE-2026-7873, or CVE-2026-93674.
id: 8c4a1f92-3e7d-4b6a-9f21-5d0e2c8a7b31
status: experimental
references:
  - https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-langflow-mongodb-and-more
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.execution
  - attack.t1059
  - cve.2026.0768
  - cve.2026.10134
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'uvicorn'
      - 'langflow'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Langflow custom components that intentionally invoke subprocesses (rare; tune per deployment)
  - Health-check or orchestration scripts running under the same interpreter
level: high
---
title: Windows Python Process Spawning Command Interpreter - Langflow Post-Exploitation
description: Detects python.exe spawning cmd.exe or powershell.exe on Windows hosts running Langflow development instances, indicating code execution via the Langflow Metasploit modules.
id: 2f7b9d41-6a3c-4e58-b184-9c0d5e6f7a22
status: experimental
references:
  - https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-langflow-mongodb-and-more
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.execution
  - attack.t1059.003
  - cve.2026.0769
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\python.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Python-based build or automation tooling (Ansible, CI agents) — baseline per host before deploying broadly
level: high
---
title: Suspicious Requests to Langflow API Endpoints from External Sources
description: Detects inbound HTTP requests to Langflow API and flow-execution paths originating from external addresses, which may indicate reconnaissance or exploitation attempts against the Langflow CVE cluster.
id: 5e1c8a36-9b42-4d7f-a603-8f2b4d6e9c14
status: experimental
references:
  - https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-langflow-mongodb-and-more
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.0768
  - cve.2026.93680
logsource:
  category: proxy
detection:
  selection_uri:
    cs-uri|contains:
      - '/api/v1/flows'
      - '/api/v1/process'
      - '/api/v1/validate'
      - '/api/v1/custom_component'
      - '/api/v1/login'
      - '/api/v1/auto_login'
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
  condition: selection_uri and selection_method
falsepositives:
  - Legitimate internal Langflow API usage — scope this rule to externally sourced requests at your reverse proxy or WAF
level: medium

// Hunt 1: Python/Uvicorn spawning shells or download utilities (Linux Syslog or EDR)
// Targets post-exploitation from the Langflow CVE cluster (CVE-2026-0768, -0769, -10134, -7873, -93674)
let SuspiciousChildren = dynamic(["sh", "bash", "dash", "curl", "wget", "nc", "ncat", "socat"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("python", "python3", "uvicorn")
    or InitiatingProcessCommandLine has_any ("uvicorn", "langflow")
| where FileName has_any (SuspiciousChildren)
| project TimeGenerated, DeviceName, AccountName,
          InitiatingProcessCommandLine, FileName, ProcessCommandLine, RemoteIP
| order by TimeGenerated desc;

// Hunt 2: Inbound requests to Langflow API paths via firewall/proxy CEF logs
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("/api/v1/flows", "/api/v1/process", "/api/v1/custom_component",
                            "/api/v1/validate", "/api/v1/auto_login")
| where RequestMethod in ("POST", "PUT", "PATCH")
| summarize RequestCount = count(), DistinctSources = dcount(SourceIP)
    by SourceIP, RequestURL, DestinationHostName, bin(TimeGenerated, 1h)
| order by RequestCount desc;

// Hunt 3: Outbound connections from Langflow hosts to rare external destinations
// Useful for containerized deployments lacking process telemetry; tag Langflow hosts in a watchlist first
let LangflowHosts = (_GetWatchlist('LangflowHosts') | project SearchKey);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where DeviceName in (LangflowHosts)
| where InitiatingProcessFileName has_any ("python", "python3", "uvicorn")
| where RemoteIPType == "Public"
| where RemoteUrl !has_any ("openai.com", "anthropic.com", "pypi.org", "huggingface.co") // expected egress
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, RemoteIP, RemoteUrl, RemotePort
| order by Connections asc; // rare destinations surface first

-- Hunt: Langflow Post-Exploitation Process Lineage and Artifacts
-- Deploy across Linux/Windows fleet; targets CVE-2026-0768/0769/10134/7873/93674 post-exploitation

LET suspicious_children <= SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)^(sh|bash|dash|curl|wget|nc|ncat|cmd\.exe|powershell\.exe|pwsh\.exe)$'

LET python_parents <= SELECT Pid, Name, CommandLine
FROM pslist()
WHERE CommandLine =~ '(?i)(uvicorn|langflow)'
   OR Name =~ '(?i)python'

SELECT child.Pid AS ChildPid,
       child.Name AS ChildName,
       child.CommandLine AS ChildCommandLine,
       child.Username AS ChildUser,
       child.CreateTime AS ChildStartTime,
       parent.Pid AS ParentPid,
       parent.CommandLine AS ParentCommandLine
FROM suspicious_children AS child
JOIN python_parents AS parent
ON child.Ppid = parent.Pid

#!/bin/bash
# Langflow CVE cluster remediation check — CVE-2026-0768, -0769, -10134, -93680, -7873, -93674
# Run on each host identified as running Langflow

set -e

echo "=== [1] Identify Langflow installation and version ==="
pip show langflow 2>/dev/null | grep -E '^(Name|Version|Location)' || echo "langflow not found via system pip"
# Check virtualenvs and containers
find /opt /home /srv -maxdepth 4 -name "langflow*" -type d 2>/dev/null | head -20
docker ps --format '{{.Names}} {{.Image}}' 2>/dev/null | grep -i langflow || echo "no langflow containers running"

echo "=== [2] Check for network exposure on default port 7860 ==="
ss -tlnp 2>/dev/null | grep -E ':7860' || echo "port 7860 not listening"
# Flag any listener bound to 0.0.0.0 (internet-reachable risk)
ss -tlnp 2>/dev/null | grep -E '0\.0\.0\.0:7860' && echo "WARNING: Langflow bound to all interfaces" || true

echo "=== [3] Check Langflow process lineage for active compromise ==="
ps auxf | grep -E '(uvicorn|langflow)' | grep -v grep || echo "no langflow process found"
# Look for shells parented to python (post-exploitation indicator)
ps -eo pid,ppid,comm | awk 'NR==FNR{py[$1]; next} ($2 in py) && ($3 ~ /^(sh|bash|curl|wget|nc)$/) {print "SUSPICIOUS:", $0}' <(ps -eo pid,comm | awk '$2 ~ /python/ {print $1}') - || true

echo "=== [4] Upgrade Langflow to latest patched release ==="
# Affected: 1.0.0 through 1.11.4 — upgrade to the newest release > 1.11.4
pip install --upgrade langflow 2>&1 | tail -5
pip show langflow | grep -E '^Version'

echo "=== [5] Hardening verification ==="
echo "- Confirm LANGFLOW_SUPERUSER credentials are not defaults"
echo "- Confirm Langflow is NOT reachable from the internet (place behind VPN/SSO reverse proxy)"
echo "- Rotate all LLM API keys and DB credentials stored in any instance that was exposed"
echo "=== Done. Review all WARNING and SUSPICIOUS output above. ==="