CVE-2026-59726

Critical · CVSS 10.0

ruflo — Unauthenticated RCE via exposed MCP bridge endpoint (OS Command Injection / Missing Authentication)

CVSS: 10.0; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-78, CWE-306, CWE-942

Description

Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns. This issue is fixed in version 3.16.3.

Search profile — drives PoC discovery

Symbols POST /mcpPOST /mcp/:grouptools/callterminal_executeMCP bridgeAgentDBdocker-composeprovider API keys

Keywords CVE-2026-59726rufloGHSA-c4hm-4h84-2cf3MCP bridge unauthenticatedterminal_execute RCEruflo docker-compose exploitruflo mcp endpoint no authAgentDB poisonruflo v3.16.3

Versions: < 3.16.3

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

ruvnet/ruflo valid MVP

known researcher · cited in references

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-11T00:00:26.000Z · profiled 2026-07-11T00:30:26.000Z