CVE-2026-10134

CVSS

—

EPSS

—

CISA KEV

Not listed

Exploitation

No report

Public exploits

None seen

State

Unknown

Coverage

• 

  Rapid7◆Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards4 hours ago

  Metasploit Wrap Up: Langflow, MongoDB, and More

  This release adds multiple new modules, and 6 of those modules point at a single target: Langflow, the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680), 3 unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134)…

  ↗rapid7.com/blog/post/pt-metasploit-wrap-up-lang…(opens the publisher's site in a new tab)

What we observed