What happened
On October 23, 2026, Rapid7's Metasploit wrap-up added six modules aimed at Langflow, the open-source low-code builder for LLM agents and workflows: three unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769 and CVE-2026-10134), two code execution flaws Rapid7 lists as authenticated (CVE-2026-7873 and CVE-2026-93674) and an authentication bypass (CVE-2026-93680), together spanning Langflow 1.0.0 through 1.11.4. The headline flaw, CVE-2026-10134 (CVSS 10.0 per IBM), lets anyone run Python on the server through a flow marked public, and IBM's bulletin says an attacker can then read every secret the Langflow process holds, alter stored flows and conversations, reach internal services and cloud metadata endpoints, and persist by editing the flow's code. Threat Frontier notes the bugs were already public for months; the change is that working exploit code is now in a standard attack framework. (Rapid7: Metasploit Wrap Up: Langflow, MongoDB, and More, Oct. 23, 2026)
Note on figures: CVSS scores come from IBM's bulletins and NVD as reported by Threat Frontier. Rapid7 lists CVE-2026-93674 as authenticated while IBM and NVD score it as needing no login; Threat Frontier could not verify CVE-2026-93680 in NVD as of October 24. Version ranges for the modules are Rapid7's.
What it means for Canada: our assessment
Assessment: no Canadian victims are reported. Canadian teams that stood up Langflow to prototype chatbots, RAG assistants or internal agents, often on a cloud VM with the port open, are exposed if they are below the fixed releases, and those instances usually hold API keys for OpenAI, Anthropic, vector databases and internal systems.
- Sectors
- SaaS and AI startups · Banks and fintechs · Insurance · Universities and research labs · Marketing and agencies · Government digital teams
- Tools involved
- Langflow · DataStax / IBM Langflow deployments · LLM API keys (OpenAI, Anthropic, Azure OpenAI) · Vector databases connected to Langflow · Cloud VMs on AWS, Azure and Google Cloud Canadian regions
- Canadian rules
- PIPEDA: if an exploited Langflow instance exposes customer conversations or personal information, report breaches with a real risk of significant harm to the Privacy Commissioner, notify affected people and keep a breach record
Quebec Law 25: record every confidentiality incident and report serious ones to the Commission d'accès à l'information
OSFI B-13: federally regulated financial institutions must patch and manage technology risk, including AI tooling, and report material technology or cyber incidents to OSFI
Provincial health privacy laws (for example Ontario's PHIPA): custodians must report privacy breaches involving health information stored in or reachable from an AI workflow tool
Assessment, not documented exposure. The sources do not name Canadian victims. The exposure is an assessment: Langflow is a free, widely used agent builder, and the flaws are reachable over the network with no login, so any Canadian organization running an unpatched, internet-facing instance faces the same risk wherever it is hosted.
Takeaways for Canadian businesses
- BusinessFind every Langflow instance your teams run, including test VMs and containers, and upgrade to 1.12.3 or later (Threat Frontier notes 1.13.0 is the newest release); 1.10.0 is IBM's minimum fix for CVE-2026-10134, but 1.12.3 also covers CVE-2026-7873 and CVE-2026-93674. IBM lists no workaround.
- BusinessTake Langflow off the open internet and put it behind single sign-on or a VPN, since CVE-2026-0768 and CVE-2026-0769 have no documented fix and network isolation is the only control for them.
- BusinessReview every flow marked PUBLIC, switch off public access where it is not needed, and check each flow's tool_code for edits nobody on your team made, because CVE-2026-10134 lets an attacker persist by rewriting it.
- BusinessAfter patching, rotate the LLM API keys, database credentials and cloud keys the Langflow process could read, and check logs for unexpected requests to /api/v1/build_public_tmp/ and validate endpoints or for the Python process spawning shells.
- BusinessReport a confirmed compromise to the Canadian Centre for Cyber Security (cyber.gc.ca or 1-833-292-3722), and if personal information was exposed, assess it under PIPEDA's real-risk-of-significant-harm test for a report to the Privacy Commissioner.
For the Canadian AI sector
Langflow is one of the default ways Canadian AI teams prototype agents quickly, and the record of repeated critical flaws makes 'it was only a prototype' an incident-report line. Expect security reviewers at banks and government buyers to ask whether low-code agent builders are patched, behind authentication and holding only scoped keys.
Written by AgentsNorth from the source below. General information, not legal or security advice.