Trending
CVE-2026-59726

CVE detail

CVE-2026-59726

Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns. This issue is fixed in version 3.16.3.

CVSS 10.0 · CriticalBuzz score 33.8

Buzz score

Why this CVE is surfacing

Buzz score total 33.8

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 20.8 · diversity 13.0 · KEV 0.0 · OTX 0.0 · PoC 0.0

Mention score

20.8

7 evidence mentions in the snapshot

Diversity score

13.0

4 sources across 2 categories

KEV score

0.0

No KEV entry observed

OTX score

0.0

0 OTX pulses

PoC score

0.0

0 repos · best confidence N/A

Best PoC traction

Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions: 7; within the 30d window
Peak daily: 4; highest bucket

Evidence

Source links by recency

Newest mentions first

7 source links · newest first

Critical Ruflo flaw lets attackers hijack AI agents through exposed MCP bridgeCSO Online
an exposed Model Context Protocol (MCP) bridge, according to research published by Noma Security. The flaw, tracked as CVE-2026-59726 and dubbed RufRoot, carries a maximum CVSS score of 10.0 and affects Ruflo versions prior to 3.16.3, Noma Security wrote in a blog post . The vulnerability allows attackers to execute arbitrary code, steal large languag
newswww.csoonline.comJul 30, 2026, 12:29 PM
Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI MemoryThe Hacker News
Claude Code and OpenAI Codex, that could result in unauthenticated remote code execution. The vulnerability, tracked as CVE-2026-59726 (CVSS score: 10.0), impacts all versions of the project before version 3.16.3. It has been codenamed RufRoot by Noma Security's
newsthehackernews.comJul 29, 2026, 3:39 PM
Patch-Resistant 'RufRoot' Flaw Can Unleash Malicious AI Agent SwarmsDark Reading
ally compromised even after it's been patched. Researchers at Noma Security's Noma Labs discovered the flaw, tracked as CVE-2026-59726, in Ruflo , formerly called Claude Flow and which hosts AI agent swarms for Codex and Claude Code , they revealed today . The vulnerability, which received the highest CVSS severity score of 10, allowed them to access t
newswww.darkreading.comJul 29, 2026, 2:40 PM
https://github.com/ruvnet/ruflo/security/advisories/GHSA-c4hm-4h84-2cf3github.com
No excerpt available.
Exploitgithub.comJul 9, 2026, 6:16 PM
https://github.com/ruvnet/ruflo/releases/tag/v3.16.3github.com
No excerpt available.
Exploitgithub.comJul 9, 2026, 6:16 PM
https://github.com/ruvnet/ruflo/pull/2521github.com
No excerpt available.
Exploitgithub.comJul 9, 2026, 6:16 PM
https://github.com/ruvnet/ruflo/commit/d00a0a40cd8bdbca877ac7f675f416bdc69accd1github.com
No excerpt available.
Exploitgithub.comJul 9, 2026, 6:16 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars

No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence

CVE-2026-65310
ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive C…
CVSS 7.5 · High
1 mention
CVE-2026-45695
Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to…
CVSS 9.8 · Critical
4 mentions
CVE-2026-46339
9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated regist…
CVSS 10.0 · Critical
2 mentions
CVE-2026-59148
Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as use…
CVSS 8.8 · High
5 mentions
CVE-2026-54088
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication f…
CVSS 9.3 · Critical
1 mention
CVE-2026-49980
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticat…
CVSS 9.8 · Critical
4 mentions

External lookup

Potential internet exposure

Potential exposure only — not proof of vulnerability.Shodan results indicate potentially internet-exposed products, not confirmed vulnerable systems. They do not confirm that any returned system is vulnerable to CVE-2026-59726.

Product-level CPE searches intentionally omit version fields and NVD version-range or configuration certainty. Verify the exact product version and configuration independently.

Sign-in required. Shodan requires you to sign in to run these filter searches.

Product CPE queries

Derived from this CVE's existing NVD CPE 2.3 records; the application, operating-system, or hardware part is retained.

Product query unavailableNo valid raw CPE 2.3 product record is available for this CVE, so no product-level Shodan query is shown.

Exact CVE query

Eligible paid Shodan plan required

Shodan's exact vuln: filter is separate from the product searches above and requires an eligible paid Shodan plan.

vuln:CVE-2026-59726Search this CVE on Shodan

These are outbound search links only. cvebuzz makes no Shodan API call, uses no Shodan API key, and does not display live result counts.

Metadata

Canonical fields

NVD status

Deferred

Published

Jul 9, 2026

Modified

Jul 10, 2026

Official record

Authoritative NVD record

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE IDs

Vendor classifications

Unavailable

How this vector reads

CVSS 3.1 base metrics decoded below. This explanation does not recalculate or change the NVD score.

Attack Vector (AV): Network. The vulnerable system can be reached across network boundaries.
Attack Complexity (AC): Low. No special conditions beyond the attacker-controlled steps are required.
Privileges Required (PR): None. The attacker needs no privileges on the vulnerable system.
User Interaction (UI): None. Exploitation does not require another user to act.
Scope (S): Changed. Impacts can cross into a different security authority.
Confidentiality Impact (C): High. There is a total or serious impact to this security property.
Integrity Impact (I): High. There is a total or serious impact to this security property.
Availability Impact (A): High. There is a total or serious impact to this security property.

Signals

Exploitation indicators

0 stored signals · no KEV · 0 OTX pulses