Vulnerability · Published Jul 9, 2026 · Assigned by GitHub_M

CVE-2026-59726Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment

Critical 10.0

In plain English

A critical-severity OS command injection in ruflo from ruvnet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)3.0%top 12.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns. This issue is fixed in version 3.16.3.

Affected products (as reported)

Vendor	Product	Versions
ruvnet	ruflo	< 3.16.3

Weakness: CWE-78, CWE-306, CWE-942 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/ruvnet/ruflo/security/advisories/GHSA-c4hm-4h84-2cf3 x_refsource_CONFIRM
https://github.com/ruvnet/ruflo/pull/2521 x_refsource_MISC
https://github.com/ruvnet/ruflo/commit/d00a0a40cd8bdbca877ac7f675f416bdc69accd1 x_refsource_MISC
https://github.com/ruvnet/ruflo/releases/tag/v3.16.3 x_refsource_MISC