Metasploit Wrap Up: Belgian Waffles, Chocolates, and…Modules-Frites?

What it is

Five new Metasploit modules from this wrap-up, with the standout being auxiliary/gather/gitlab_file_read_cve_2026_85706, an unauthenticated arbitrary file read exploit for GitLab CE/EE that the post explicitly flags as exploited in the wild. The other key addition is a pair of native mitm6-style modules for Kerberos relay: auxiliary/spoof/dhcp/dhcpv6_dns_takeover and auxiliary/spoof/ipv6/ipv6_ra_dns_takeover (CVE-2026-20929).

How it works

The GitLab flaw lives in the repository commits and files APIs, requiring no authentication. The DNS takeover modules work by impersonating network infrastructure: dhcpv6_dns_takeover acts as a rogue DHCPv6 server, while ipv6_ra_dns_takeover acts as a rogue IPv6 router advertisement sender (RFC 8106). Both coerce Windows and RFC 8106-compliant clients into adopting the attacker's host as their recursive DNS server, setting up a Kerberos authentication relay chain.

flowchart LR
    A[Attacker host] -->|rogue DHCPv6 offer| B[Windows client]
    A -->|rogue IPv6 RA w/ RDNSS| B
    B -->|adopts attacker as DNS| C[Kerberos auth traffic]
    C -->|relayed| D[Attacker-controlled relay target]

Preconditions / Affected

• GitLab CE/EE: versions 18.7 up to (not including) 19.1.8, 19.2.6, and 19.3.2 — patch to those fixed versions.
• DHCPv6/IPv6 RA takeover: targets must be on a network segment reachable by the attacker (same local network for DHCPv6/RA spoofing); relevant to unconfigured/unused IPv6 stacks on Windows networks, a condition the post calls common.
• Langflow RCE (CVE-2026-18729): requires authentication; affects versions ≤1.11.1; exploited via custom components (arbitrary Python execution).
• Kate persistence module: no CVE, cross-platform persistence technique, no further preconditions stated.

What to do

• Patch self-hosted GitLab immediately if running 18.7 through the affected pre-fix builds — the post says to stop reading and patch given active exploitation.
• Upgrade Metasploit via msfupdate to pull in these modules for testing/detection purposes.
• For the ZoomEye search module (unrelated to the CVEs above), note it now uses the v2 API with a three-attempt retry limit and caps at 10 results per page to fix prior infinite-loop/truncation bugs — relevant if you depend on that module's output format.

Caveats

The post does not give exploitation prerequisites (e.g., existing DHCPv6/IPv6 infrastructure state) beyond "never configured, never disabled" IPv6 stacks being common; no CVSS scores or exploitation complexity details are provided for any of the three CVEs.