security_identifier

CVE-2026-18729

CVE identifier for an authenticated remote code execution flaw in Langflow through version 1.11.1.

Current clusters

Metasploit ships a public exploit for an unauthenticated GitLab file-read flaw

Rapid7 published a Metasploit module for CVE-2026-85706, an unauthenticated file read it says is already exploited against self-hosted GitLab. Every CE and EE build from 18.7 stays exposed until 19.1.8, 19.2.6 or 19.3.2.

Publishers:blog.rapid7.com

Reality

Evidence55
Adoption: Insufficient
Hype gap+15
Incentives35
Confidence55