{"data":{"id":"138616a5-38d8-4abd-a749-ee2081c03109","title":"CVE-2026-59726: Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment…","summary":"CVE-2026-59726 affects Ruflo, an agent meta-harness for Claude Code and Codex, before version 3.16.3. The default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication. An unauthenticated network attacker could invoke tools/call to terminal_execute, obtain a shell in the bridge container, read provider API keys, and poison AgentDB learning-store patterns.","solution":"Fixed in version 3.16.3.","labels":["security","industry"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59726","publishedAt":"2026-07-09T18:16:57.337Z","cveId":"CVE-2026-59726","cweIds":["CWE-78","CWE-306","CWE-942"],"cvssScore":"10","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Ruflo","Claude Code","Codex"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Ruflo unauthenticated MCP bridge endpoints allow command execution","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.03019,"epssCheckedAt":"2026-10-14T18:06:00.235Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:46:53.333Z","patchAvailable":null,"disclosureDate":"2026-07-09T18:16:57.337Z","capecIds":["CAPEC-115","CAPEC-88"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}