CVE-2026-59726
CRITICAL · 10.0 EPSS 0.5%Patch released, real vuln, mass media coverage, no confirmed exploitation; likely HACK.
What: Ruflo (Claude Code/Codex agent harness) versions <3.16.3 expose unauthenticated MCP bridge endpoints allowing remote code execution, shell access, API key theft, and agent memory poisoning. CVSS 10.0.
Why it matters: Patch released 21 days ago (3.16.3 fixes it); mass coverage across security media and developer platforms; no KEV listing yet but threat is real — unauthenticated RCE on a system touching AI credentials and agent state. Active chatter shows defenders and teams aware of exposure window.
Where it's seen: Bluesky posts from security researchers and outlets (HackerNews, OffSeq, BlindThoughts); links to threat intel; multilingual discussion; upgrade guidance circulating. No confirmed in-the-wild exploitation reported, but CVSS 10.0 and simple attack surface drive urgency.
RISK: CRITICAL — Unauthenticated RCE exposing API keys and agent memory; trivial network attack surface.
Description
Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns. This issue is fixed in version 3.16.3.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High