Unauthenticated RCE via Open MCP Bridge in Ruflo Agent Harness
CVSS 10.0: Ruflo's MCP bridge exposes 233 tool endpoints to unauth network access, enabling RCE, API key theft, and AI memory poisoning. Patched in 3.16.3.
- Vendor
- Ruflo
- Product
- Ruflo agent meta-harness (all versions before 3.16.3)
- CVSS
- 10.0
- EPSS (exploit probability)
- 6.2%
- Status
- patched
- Published
Is CVE-2026-59726 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-59726 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 6.2% (scored November 12, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-59726 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-59726, named RufRoot by Noma Security, is a maximum-severity vulnerability in Ruflo — an open-source Model Context Protocol harness for Anthropic Claude Code and OpenAI Codex. The flaw stems from a default docker-compose configuration that binds Ruflo’s MCP bridge to all network interfaces without requiring authentication, exposing 233 tool endpoints (shell execution, database operations, AI memory storage) to any network-reachable attacker.
Discovered by researcher Eli Ainhorn and disclosed June 30, 2026, the vulnerability allows an unauthenticated attacker to achieve remote code execution, harvest stored LLM API keys, extract conversation histories, and poison AI memory patterns in ways that can influence future model behavior.
Fix: Version 3.16.3 (released same day as disclosure) restricts the MCP bridge to localhost, gates terminal execution behind server-side controls, and enables MongoDB authentication. Any Ruflo instance that was network-accessible before the patch should be treated as potentially compromised — rotate API keys.
No active exploitation has been observed as of disclosure.
References: The Hacker News coverage · NVD entry
