Ruflo MCP Scores Perfect CVSS 10 in Unauthenticated RCE Flaw

A maximum-severity vulnerability has been disclosed in Ruflo, an open-source harness that bridges Anthropic Claude Code and OpenAI Codex to the Model Context Protocol (MCP). Tracked as CVE-2026-59726 and codenamed RufRoot by Noma Security, the flaw carries a CVSS score of 10.0 — the ceiling — and allows unauthenticated remote code execution on any instance reachable over the network.

The root cause is a configuration default, not a logic error buried in the codebase. Ruflo’s default setup binds its MCP bridge to all network interfaces, which leaves the tool’s 233 exposed endpoints — shell execution, database operations, AI memory storage — open to any network peer without any authentication check. Researcher Eli Ainhorn at Noma Security documented the scope of access: large language model API keys, stored conversation histories, and the ability to corrupt AI memory in ways that would influence future model behavior. That last item, memory poisoning, is less routine than a simple credential theft and worth noting for teams running multi-user or shared Ruflo deployments.

The disclosure went cleanly. Ainhorn reported the issue on June 30, 2026, and a patch arrived the same day. Version 3.16.3 restricts the bridge to localhost by default, gates shell execution on the server side, and enables authentication for the MongoDB backing store. Not a complicated fix — the kind that makes you wonder how the original default survived review.

What to do: Update to Ruflo 3.16.3 or later. If an immediate patch isn’t possible, confirm that the MCP bridge port is blocked at the network boundary — a local-only install is low risk, an exposed container on a shared host is not. If Ruflo was running in a network-accessible configuration before the patch, treat any stored LLM API keys as potentially compromised and rotate them.

No exploitation in the wild has been reported, which is consistent with the tool’s relatively narrow install base. That said, “unauthenticated and network-reachable” doesn’t stay quiet long once details are published. The pattern of developer tooling shipping with convenience-first defaults — Gitea’s RCE via planted Git hooks followed the same trajectory earlier today — is one of those recurring problems that each new wave of tooling tends to rediscover on its own schedule.

And now it’s showing up in AI coding harnesses. That’s not surprising, but it is the sort of thing that gets more interesting as these tools accumulate more access to more systems.

For full technical analysis, see Noma Security’s RufRoot writeup via The Hacker News and the CVE-2026-59726 entry.