Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules

What it is

This is the Rapid7 Metasploit weekly wrap-up adding 12 new modules and several fixes/enhancements. The existing "test summary" carries no content, so everything below is new to the reader.

What to do

Key new modules worth tracking:

• vLLM Multimodal Heap-Address Info Leak Scanner (scanner/http/vllm_multimodal_info_leak, CVE-2026-22778): detects vLLM OpenAI-compatible servers where sending an invalid image to the multimodal endpoint triggers a PIL error that leaks a heap address — chainable with a heap overflow for RCE.
• N-able N-central Struts BeanUtils Unauthenticated RCE (linux/http/nable_ncentral_unauth_rce_cve_2026_86218, CVE-2026-86218): unauthenticated RCE against N-able N-central versions 2026.3.1.13 and below.
• snapd Local Privilege Escalation (linux/local/cve_2026_3888, CVE-2026-3888): TOCTOU race condition in snap-confine, the SUID binary enforcing snap sandbox boundaries.
• DirtyClone LPE (linux/local/dirtyclone_cve_2026_43503, CVE-2026-43503): local Linux privilege escalation exploit.
• dizqueTV Unauthenticated RCE (multi/http/dizquetv_rce, CVE-2024-58286 / EDB-52079): targets the Node.js-based IPTV streaming server.
• Langflow Unauthenticated RCE (multi/http/langflow_rce_cve_2026_0770, CVE-2026-0770): affects Langflow versions <= 1.7.3, via the validate endpoint.
• LiteLLM Proxy MCP Test Endpoint Command Execution (multi/http/litellm_mcp_test_cmd_injection, CVE-2026-42271): command execution in BerriAI LiteLLM proxy's MCP "test" REST endpoints.
• OpenCTI JSON Mapper safeEjs Sandbox Escape RCE (multi/http/opencti_jsonmapper_safeejs_rce): sandbox escape giving RCE as root inside OpenCTI's API container, versions >= 6.8.16.
• Ollama Windows Auto-Update Path Traversal Persistence (windows/persistence/ollama_auto_update, CVE-2026-42249): persistence via path traversal in Ollama's Windows auto-update.
• Linux PAM Backdoor (post-exploitation, linux/manage/pam_backdoor): uploads (or compiles on-target if not x64) a malicious PAM .so into the auth chain for persistent credential capture.
• 12 new Windows AArch64 fetch payloads (FTP/HTTP/HTTPS/TFTP exec and reverse_tcp variants).

Also notable fixes: search type:-aux now correctly excludes auxiliary modules (matching type:-auxiliary), and MSSQL/SSH/PostgreSQL login scanners had console output prefix bugs fixed (missing/duplicate ip:port).

Caveats

The page itself flags an error: it could not resolve the pull request for a listed CVE-2000-0979 SMB share password enumerator module (commit reference given, PR lookup failed) — treat that module's provenance as unverified per the post's own note.