Description
Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns. This issue is fixed in version 3.16.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ruvnet | ruflo | < 3.16.3 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Ruflo MCP Bridge 3.16.2 - Remote Code Execution EDB-52705 · remote · Nov 11, 2026
GitHub 1 repository
-
HORKimhab/CVE-2026-59726 ★ 0 · Jul 30, 2026
CVE-2026-59726 - Draft or Todo
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- ruflo MCP Bridge - Unauthenticated RCE via terminal_execute http/cves/2026/CVE-2026-59726.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.