CVE-2026-59726
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Ruflo prior to 3.16.3 exposes MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to execute commands in the bridge container, read provider API keys, and poison AgentDB learning-store patterns.
Risk Assessment
An attacker can gain full control over the bridge container, steal sensitive API keys, and disrupt the agent system, leading to confidentiality and integrity breaches.
Recommendation
Immediately upgrade Ruflo to version 3.16.3 or later. If upgrading is not possible, restrict access to MCP bridge endpoints to trusted networks only.
Original NVD description (English source)
Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns. This issue is fixed in version 3.16.3.